Not quite. GDPR applies to governments as well. But there is a legal basis called "public task": "the processing is necessary for you to perform a task in the

Not quite. GDPR applies to governments as well. But there is a legal basis called "public task": "the processing is necessary for you to perform a task in the public interest or for your official functions, and the task or function has a clear basis in law" So no the govt can't "just" spy on you. But if they have, say, a court order, or let's say the law allows it if they have sufficient evidence, then yes. Otherwise, government bodies are expected to behave like everyone else. My experience is that government bodies tend to be more concerned with legal compliance than private entities.