GDPR doesn't apply when "national security" is at stake, so the governments themselves are not restricted by it.