The EU isn't one single decision-maker. There was a brief period where the EU had both the GDPR and the Data Retention Directive, which were practically contradictory (the courts nuked the Data Retention Directive).