boomers

Short answer: GDPR does not apply to EU state surveillance (intentionally).

Slight nitpicking, sorry. But do note that EU does not equal Europe. The European Union covers a decent portion of Europe though but not all countries. To complicate things though there are complex deals between countries so often these laws also do go through local parliaments and get implemented in one way or another.

I can speak with some knowledge about the situation in the Netherlands where we continuously take a step forward (GDPR) and two steps back when it comes to privacy. Police and intelligence agencies either lobby enough to have a new surveillance technology pass through our legislators, as was the case with the dragnet legislation, or surveillance technology is implemented that is plainly against current legislation, as is the case with biometric surveillance. The case that police and intelligence agencies make over and over again is that surveillance is needed to counter a perceived threat e.g terrorism. Although the Netherlands has seen very little terrorism over the last two decades the lobby is apparently very effective. The most simple explanation that I can offer is that legislators and many citizens choose to be ‘better safe than sorry’ and easily throw away privacy for perceived safety. In that regard I suppose that regretfully citizens from Europe differ very little from citizens from other parts of the world.

As usual things are a bit more complex…

GDPR (while a relative good piece of legislation) was mainly pushed through to make business difficult for non-EU based tech companies and/or give local tech-companies a little “help”. Didn’t quite work out as intended, but the intend of “regulatory capture” was clearly visible in much of the parliamentary discussions.