The article itself cites GDPR, Arts. 6(1)(c) which, aside from 6(1)(f), are exactly the provisions that can and should be used to comply with the GDPR while allowing for U.S. discovery. The rest of the text reads like scaremongering to me.