The EU is in effect much closer to a confederation than a federation. A lot of the problematic aspects of how the EU is set up are attempts to work around the limitations imposed by not having sufficient public support to reform it into a more federal structure. To some that's a feature, of course, to others it's a significant nuisance.

And the practical effect of this is you get a race to the bottom: countries compete on how lax they are going to be in enforcing GDPR so as to attract American tech companies.

The Data Protection Commission in Ireland are remarkably lax about enforcing it because the government quite likes the tax revenue that Google, Apple and Meta brings them.

No, the clue is in the name, "General Data Protection Regulation". If it were a directive, it would be called GDPD.