It is a sensible requirement but it will require a major shift in how companies think about what data it collect and what will the storage retention policies.

It is a sensible requirement but it will require a major shift in how companies think about what data it collect and what will the storage retention policies. Siginicant data collected on individuals across the world via social media are held with US companies that must follow the processes put in place to provide Law Enforcement with data regardless of the citizenship of the person, when someone commits a crime in one jurisdiction, that local law enforcement has the right to collect from the business, data needed to support their case. The problem is when Bob from country X commits a crime "social media business" may have relevant information on, how cooperative will the US company be in helping country X? Especially if country x is politically unpopular at the moment. Require local subsidiaries follow data protection and retention that adheres to local law. Everything gets much easier. Another issue, "social media business" has a tone of information on citizens of country X, now the citizens of country X are vulnerable to manipulation which could disrupt the stability of country X. What do they do?