Not sure where you're going with this.Governments don't control this information. It's the difference between Microsoft and Google having surveillance over user information and them sharing it with the government. My point is that I don't think it is any better if these corporations don't share this information with governments. So, I'd want something like GDPR to be just the starting point of user rights, not the end point.
Corporations like Google purport to own or have rights over anything you place with them. That's not ideal. Given their corporate interests, I wouldn't view AI by Microsoft or Alphabet as somehow distinct from their ongoing efforts to monetise their users. Their users create the value, which these corporations get for free and sell back to them. I'm not sure that what society gets back from this deal is as much as what these companies get in their offshore bank accounts, where they don't pay tax on it.
In the context of this issue, the Samsung employee, of their own volition, uploaded internal corporate data, to an entity controlled by some other company.
The Samsung employee made a major mistake.