There is also the case of the secret Palantir contract in Greece. The bounds of GDPR need clarifying in respect to non EU governments and also public private partnerships.