That's how international espionage works. Everyone is spying on everyone else. Do you think that there aren't any European spies in the USA?
What I do know: U.S. citizens are protected by GDPR when they are in the EU.
Foreign intelligence agencies could not do much if they had to follow all the foreign laws. It's their job to gather intelligence abroad. What do you expect them to do? "Oh shit - this Russian law forbids us from gathering intelligence in Russia - we'd better stop and go home"?
Snowden's revelations didn't surprise me in the slightest. I already knew that US intelligence agencies could spy on me if they wanted to.
And I don't give a crap if they spy on US citizens, because I'm not an American.