I like GDPR but that relates more to corporate data collection than government surveillance. Mass surveillance facilitated by third party corporations is only one kind of mass surveillance.

Supposedly China has ramped up regulations on corporate surveillance recently, implementing new restrictions on data that companies can store. That doesn’t mean the Chinese are free from surveillance.

What protections against mass surveillance does a person in the EU have?