MS Outsourced Skype, Cortana Voice Analysis to China with No Security in Place

I always wonder with this how much of those recordings are from people talking near a recording device, not the actual owner of the device. I also wonder how it manages to be compliant with GDPR, does it considers that the owner of the device is a data controller?