Perhaps. But the interaction of the GDPR and freedom of information / public records is quite complicated. For example in Sweden there’s a law that says that ac

Perhaps. But the interaction of the GDPR and freedom of information / public records is quite complicated. For example in Sweden there’s a law that says that access to public records (Tryckfrifrihetsförordningen) takes precedence over the GDPR. On the other hand EU law generally takes precedence over national law and there is no exception in the GDPR itself AFAIK. Public records can however only be accessed by request, and only by a Swedish citizen, so this situation probably wouldn’t fall under that exception had this happened in Sweden. IANAL but I think this would have been a violation of the GDPR had it happened in Sweden, and a quite serious one at that. Formally I think it could also fall under various espionage laws since there are foreign powers involved (but probably not in practice).