[samus]

The courts would have jurisdiction on the recipient though. The recipent has to evidence a valid reason according to GDPR to process a subject's data.

[garmaine]

The recipient is outside the EU.