GDPR is a government regulation, and governments are routinely above their own regulations, especially when it comes to intelligence. To quote one former US Vice President: "Of course it's a violation of international law; that's why it's a covert action".
GDPR provides a legal framework through which Europeans are able to get companies to honor their wishes with data .
While it has teeth, it does nothing to physically stop a bad (or unconcerned) actor from don't something you don't want with that data, and once they have it you can't put Pandora back in the box.
Once the data is out there, though, you're vulnerable. You can "destroy" it later, from the perspective of a company, by asking the company nicely to destroy it for you, but that does nothing to protect you from state actors who may have had access to the data before. In fact, a state actor would likely take "asking nicely to destroy data in accordance with the rules and regulations" as a signal of which data was the most interesting to collect and retain.
Exactly, and one of the main points GDPR is to force companies to think twice before collecting data in the first place. Thanks to GDPR significantly less data will be out there.
Computers are machines for copying data. A good computer is one that copies well, quickly and cheaply. The internet is a machine for moving copies of data around. When the internet works well, it copies data quickly and cheaply.
Ideologically, this is difficult for some people to accept. If your fortune has been based on stopping people from copying information, it is an inconvenient truth indeed. If you earn your living by preventing copying, the only options are to change everything, or deny everything.
Whilst GDPR partly aims to help educate the user about data being collected, the extend and details of such data are underestimated. Mostly because no company specifically calls out the exact data they collect; They describe it broadly to avoid having to ask for consent again when they add a new product or feature. You only truly understand what data is collected once you make use of the obligated download feature and look through the data.
Also, GDPR does not apply to Intelligence Services, their legal limitations are dodgy at best (on purpose).
