>GDPR Article 2 Material scope

>2. This Regulation does not apply to the processing of personal data:

>by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security.

Maybe...in a world where lawmakers didn't put huge exemptions into GDPR for governments and law enforcement etc. Which they did.