They certainly violated the spirit, but may not have violated any actual rules. I could imagine that there's some exclusion in the safe harbor rules for "nation

They certainly violated the spirit, but may not have violated any actual rules. I could imagine that there's some exclusion in the safe harbor rules for "national security". It's not clear whether the Data Protection laws were ever designed to guard against national governments. I imagine that those who wrote them were really thinking about avoiding disclosure to private individuals or other companies.