Well, I guess the truth is, personal data of EU and US citizens is sent in secret to european agencies all the time. Such institutions are all exempt from GDPR.
There are some specific justifications that are scoped to government use only, in areas such as law enforcement or collection of statistics. But agencies still need to implement the law, document the specific requirements for any type of data they collect, observe time limits on retention, produce transparency reports, and so on.