Unfortunately, governmental organizations and public authorities in general for the most part are exempt from obligations under GDPR, the most easily applicable

Unfortunately, governmental organizations and public authorities in general for the most part are exempt from obligations under GDPR, the most easily applicable loophole being that they can always argue legitimate interest or that they're simply legally required to store PII. It's next to impossible to successfully contest that argument in court.