I have to say that I've lost yet another bit of respect for the German government (and those that followed) when they did not offer asylum to Snowden.
What I do know: U.S. citizens are protected by GDPR when they are in the EU.
Foreign intelligence agencies could not do much if they had to follow all the foreign laws. It's their job to gather intelligence abroad. What do you expect them to do? "Oh shit - this Russian law forbids us from gathering intelligence in Russia - we'd better stop and go home"?
Snowden's revelations didn't surprise me in the slightest. I already knew that US intelligence agencies could spy on me if they wanted to.
And I don't give a crap if they spy on US citizens, because I'm not an American.