The Lisbon city hall is being investigated by the national data protection authority over this.

(Article in Portuguese: https://sicnoticias.pt/pais/2021-06-11-Camara-de-Lisboa-pode...)

Perhaps. But the interaction of the GDPR and freedom of information / public records is quite complicated. For example in Sweden there’s a law that says that access to public records (Tryckfrifrihetsförordningen) takes precedence over the GDPR. On the other hand EU law generally takes precedence over national law and there is no exception in the GDPR itself AFAIK.

Public records can however only be accessed by request, and only by a Swedish citizen, so this situation probably wouldn’t fall under that exception had this happened in Sweden. IANAL but I think this would have been a violation of the GDPR had it happened in Sweden, and a quite serious one at that. Formally I think it could also fall under various espionage laws since there are foreign powers involved (but probably not in practice).

There is also the case of the secret Palantir contract in Greece. The bounds of GDPR need clarifying in respect to non EU governments and also public private partnerships.

I thought GDPR does not apply to the government.