Is there an explicit carveout? The GDPR has been used against governments.