Let me guess, the Danish government will find a way to prove that GDPR doesn't apply to them.

But this is incredibly bad.

It does apply but they were allowed to have this data and GDPR does very little to protect it in that case.