Such were held and enforced by the state, not by local businesses. Say, more or less the same people who run network-scale intercepts and tracking nowadays, and collect/access/process a lot of real-word records about you. Do you really think that as a EU citizen I can go ask TSA all data they have on me and why they opened my bag last time I flew out of the US?
Intersting question. How far into state agencies does the GDPR apply in the same way it does for businesses? Can i make a GDPR request to my city library, hosptial, police or secret service? Or maybe even to the state as a whole?
