The EU is in effect much closer to a confederation than a federation. A lot of the problematic aspects of how the EU is set up are attempts to work around the limitations imposed by not having sufficient public support to reform it into a more federal structure. To some that's a feature, of course, to others it's a significant nuisance.

And the practical effect of this is you get a race to the bottom: countries compete on how lax they are going to be in enforcing GDPR so as to attract American tech companies.

The Data Protection Commission in Ireland are remarkably lax about enforcing it because the government quite likes the tax revenue that Google, Apple and Meta brings them.

It's not a race to the bottom any more than competition lowering consumer prices is a race to the bottom. It's one of the few checks on governments just demanding more and more tax money for little return.