They do not need to hijack this process, in a way as is said in article, or in comments, there are different methods already in use, successfully. So there is absolutely no need from anybody to be doing this in this way ( even if it works like they write in that article ). if they need it for state security then it does not need to be this OVERT, there are legal provisions to do this covertly IN US OR IN EU. They are even cooperating between jurisdictions. So UK is sending data from US citizens on uk servers to US, EU is sending data about US citizens on Eu servers to US, etc. And no GDPR does not cover this.