"In practice, however, an interim solution for member states has been to transfer data directly to the Canadian authorities despite the Council of the EU calling it a “legal vulnerability.” It appears to be common practice for national law enforcement to go rogue (and unsanctioned) on European standards concerning PNR. In December 2022, following a court judgement on the law that governs the use of PNR data within the EU, the European Data Protection Board said it is “likely” that most member states were not complying with the judgment, operating systems that “continue to interfere disproportionately with the fundamental rights of data subjects every day.”

Calling it a house of cards may be unwarranted, but a couple of back references nevertheless:

https://news.ycombinator.com/item?id=38552175

https://news.ycombinator.com/item?id=38551854