This is the controversy. If I am the American site, my response to said German tourist is, "No, I operate under the laws of America and therefore am bound by

This is the controversy. If I am the American site, my response to said German tourist is, "No, I operate under the laws of America and therefore am bound by no European decision." I.e. Europe has no jurisdiction over data stored outside her borders, and the citizen transmitted said data. It is indeed a reach, and unenforceable by Europe unless she personally sanctions company share-holders and agents from entry.