That the U.S. selfishly sees non-Americans as unprotected game is nothing that the EU has to respect.
What I do know: U.S. citizens are protected by GDPR when they are in the EU.
Foreign intelligence agencies could not do much if they had to follow all the foreign laws. It's their job to gather intelligence abroad. What do you expect them to do? "Oh shit - this Russian law forbids us from gathering intelligence in Russia - we'd better stop and go home"?
Snowden's revelations didn't surprise me in the slightest. I already knew that US intelligence agencies could spy on me if they wanted to.
And I don't give a crap if they spy on US citizens, because I'm not an American.