[from]

America requires dual criminality for extradition. America has no privacy law similar to GDPR so that couldn't happen + I think GDPR violations are a civil thing only (?).

[bbbbb5]

> I think GDPR violations are a civil thing only (?).

Correct, however most countries have various related criminal offences. (e.g https://www.legislation.gov.uk/ukpga/2018/12/section/170/ena...) It's extremely unlikely any of these would be relevant in this context though.