All countries spy on all other countries as well as their own citizens.
The EU statement is akin to the Madam at a bordello expressing surprise that her employees are prostitutes.
They are not concerned about the spying. They are concerned that a 30 year old contractor had access to all this intelligence, could copy it to a thumb drive and then travel to Hong Kong.