"the government sector is exempt from GDPR"
The "government sector" is not exempt from the GDPR. There are certain exceptions for such activities as law enforcement and national security. These are conceptually necessary, but what appears to have happened (as always) is over-extension of the definitions and mission creep. Unfortunately, this is to be expected. However in reality we're nowhere near building a STASI here in blighty, not least because we haven't the mechanisms for making every fifth citizen an informer or the freedom to torture and imprison without due process. State intrusion into the privacy of the non-offending public is not to be condoned, but a police state is something quite different. You'd know it if you encountered it, witness what's going on in some other parts of the planet right now.