Ya, this isn't surprising.

https://www.atlanticcouncil.org/blogs/new-atlanticist/the-un...

> states parties are obligated to establish laws in their domestic system to “compel” service providers to “collect or record” real-time traffic or content data.

That's probably the biggest poison pill. The whole data sharing thing got watered down to the point of farce. Of course the EU won't extradite Russian LGBT activists under this law. But similarly, how likely do you think it would be for North Korea to extradite its own state-sponsored cybercriminals? They can simply claim that doing so would go against their "sovereignty, security, or other essential interests". Case closed!