This is a masterpiece of creating bureaucracy that will do nothing to reduce mass surveillance and will never provide any redress to people who are spied upon.

Eu citizens will have to first complain to a national body. Here is how I think that will go:

EU citizen: "Hey I think the American government has looked at my data in a way that is not intended to be allowed by GDPR"

Two years later: National body: "You can't prove the Americans have looked at your data, we will not process this complaint".