This is an often parroted conspiracy theory rooted in novices looking at leaked documents and not really understanding the context. Just because GCHQ shares data with NSA it does not mean the program lacks controls that protect American citizens. Partner data is still filtered for US nexus and tagged appropriately as to require multiple layers of approvals and oversight to query or view.
> how sharing takes place in spite of those controls
Sharing takes place because countries have mutual data sharing agreements. It is up to the receiving country to comply with domestic laws.
For example if GCHQ has a dish pointed at a foreign communications satellite and receives all downlink communications, they might share that stream of raw data with partner countries. If NSA receives that stream the first thing that happens is it gets decoded into call data and parsed for any hint of US nexus communications at which point it gets tagged USPER and is not accessible to analysts.
But there's presumably little to stop the NSA asking GCHQ "can you give us a list of US citizen that match profile X", so does the fact that they strip it out of their local copy make a big difference?
These are the same government agencies that the Snowden leaks informed about. How many people in the government were fined or went to jail because those were revealed to the public?
