This is indeed precisely what the US CLOUD Act does, which is the reason why this situation has arisen in the first place, since it does violate GDPR for a company to transfer data to a US entity like this.