Unfortunately, the GDPR (while mostly brilliant) contains pretty extensive "national security" carve-outs, as I understand it.