Have you not yet notice that essentially all EU regulations have blanket exceptions for anything done by states.
EU states, including the EU itself, have blanket exceptions to the GPDR, for example. For example, they get to pass around private medical data, without telling anyone, supposedly in cases where they deem it to be important for investigations (not just criminal), anything to do with protection of minors, ... And because nobody cooperates well with this "for some reason", you find more than a few examples of them passing around (and using in court) WRONG private medical data. There has never been any conviction for this (DESPITE EU countries getting convicted for basing judgements on wrong medical data in their own EU courts).
EU states, including the EU itself, have blanket exceptions to the GPDR, for example. For example, they get to pass around private medical data, without telling anyone, supposedly in cases where they deem it to be important for investigations (not just criminal), anything to do with protection of minors, ... And because nobody cooperates well with this "for some reason", you find more than a few examples of them passing around (and using in court) WRONG private medical data. There has never been any conviction for this (DESPITE EU countries getting convicted for basing judgements on wrong medical data in their own EU courts).
I imagine something similar is going on here.