The CLOUD Act is extraterritorial and in direct conflict with GDPR. On a more practical level, how would the EU even know a violation occurred given the systema

The CLOUD Act is extraterritorial and in direct conflict with GDPR. On a more practical level, how would the EU even know a violation occurred given the systematic practice of adding a gag order to national security letters?