This will all be decided in courts but I believe you are both wrong. https://ec.europa.eu/info/law/law-topic/data-protection/reform/rules-business-and-organisa

This will all be decided in courts but I believe you are both wrong. https://ec.europa.eu/info/law/law-topic/data-protection/reform/rules-business-and-organisations/application-regulation/who-does-data-protection-law-apply_en https://ec.europa.eu/info/law/law-topic/data-protection/refo... You don’t have to be a citizen to get protected you do have to be in the EU. Even if you are traveling in the EU but don’t reside there you aren’t necessarily covered. In no situation does a vpn give you applicability.