GDPR has carveouts for governments and law enforcement so they can do whatever for those purposes.