The EU's position is that you can, in fact, claim in good faith that you're protecting your users when the data exists in the US, despite evidence to the contra

The EU's position is that you can, in fact, claim in good faith that you're protecting your users when the data exists in the US, despite evidence to the contrary. There have been a few court cases about this, one of which is currently in progress, and at least one of which they lost and carried on doing it anyway. In any case, it's not something you can rely on EU data protection rules to protect against right now. On the other hand, the EU has been threatening to refuse to agree on the same for the UK, despite both having the exact same data protection frameworks as it currently stands. The actual rules have at least as much to do with internaational politics as they do with protecting people's privacy.