That was largely my read of the situation too - it would be a colossal GDPR breech against every EU user, surely? That's got to be a €Billion fine??

Presumably USA are complicit in this spying on allied countries - did the countries know, is it a Five Eyes thing?