They certainly violated the spirit, but may not have violated any actual rules. I could imagine that there's some exclusion in the safe harbor rules for "national security".

It's not clear whether the Data Protection laws were ever designed to guard against national governments. I imagine that those who wrote them were really thinking about avoiding disclosure to private individuals or other companies.