Sure, but are they truly compelled by EU law to do this for people in the EU, to export encrypted data? GDPR applies to PII, and encrypted data the company can’

Sure, but are they truly compelled by EU law to do this for people in the EU, to export encrypted data? GDPR applies to PII, and encrypted data the company can’t access is not personally identifiable information, and the company doesn’t necessarily “have” the unecrypted data. It seems like Article 20 does not automatically apply here. (This all aside from the question of whether GDPR applies to Americans using American services.)