They rejected 40,000 US requests that were deemed outside the co-operation agreement and have now discovered 2,000 which are "suspicious". The article suggests

They rejected 40,000 US requests that were deemed outside the co-operation agreement and have now discovered 2,000 which are "suspicious". The article suggests the agreement excluded German and US organisations, the "suspicious" 2k were relating to other European institutions. It sounds like a case of it being within the written agreement but that the agreement was too broad, or at least should have been changed with the shift in political rhetoric.