What’s unlawful for the NSA to collect is defined by US law, not EU law. I’m sure they could ask the US nicely, and the NSA may even pretend to listen to their complaints for a little bit :)
I don’t know how EU pulled that off, but the work of the NSA is illegal just like Google storing EU citizen’s data in USA without GDPR enforcement is illegal too. Not to say it’s applicable.
In fact, you could break the US law from abroad. Ask Assange.
https://www.theguardian.com/music/2018/oct/12/israel-fines-n...
And, realistically, the EU can’t enforce GDPR outside the EU. If somebody in the UAE, for example, were to hoover up all the EU citizen data they can get their hands on what is the EU going to do? Send a strongly worded letter?
What would your country do to protect your rights?
https://www.dataguidance.com/news/uae-uae-enacts-new-federal...
Step 1: Declare yourself the lawful sovereign of your citizens in customary international law and be accepted as that both internally and globally.
Step 2: Define a fundamental (constitutional) human right to data privacy, see charta of fundamental rights of the European Union Article 8
Step 3: Create regulations that define how to lawfully handle the data of european citizens (-> GDPR, Police Directive, ...) and what happens if one disregards the fundamental right.
Honestly the whole thing becomes much easier to understand if one substitutes any other fundamental right, like the right to bodily integrity. A foreign corporation is not allowed to harvests our citizens organs without lawful basis (like written consent), even if it claims the law of its home country allows it to harvest organs as it pleases.