'Enforced' isn't the right word for that legislation - it's a derogation, meaning it's removing rules, not creating them.

Specifically, that regulation gives service providers a temporary legal mechanism to continue to scan their own traffic for CSAM, if and only if they want to do so, without breaking the law due to GDPR etc (which otherwise made doing so arguably illegal). It just re-legalized the scanning that service providers were doing voluntarily before GDPR, and which they're doing regardless outside the EU anyway.