[kuschku]

Actually, the EU wrote into the GDPR that they can do exactly that. Any company with data on EU citizen is liable, no matter where they got it from.