The EU had (until 2014 when it was ruled to violate fundamental rights) a data retention charter which required member states to store all telecommunications data generated within the EU for a period between 6-24 months[1].
The GDPR explicitly allows for government surveillance to be excluded from the directive's protection.
Privacy International and a bunch of other NGOs have filed complaints[2] against "Belgium, Czech Republic, France, Germany, Ireland, Italy, Poland, Portugal, Spain, Sweden, and the U.K." for violating rulings by the European Court of Justice over illegal mass surveillance. Here's another article[3].
[1]: https://en.wikipedia.org/wiki/Data_Retention_Directive
[2]: https://www.forbes.com/sites/emmawoollacott/2018/06/25/eu-na...
[3]: https://medium.com/privacy-international/a-new-era-of-mass-s...