That's the argument made by the recent ECJ ruling on the matter, not by shady players. As a business, technically you're simply not allowed to have dealings wi

That's the argument made by the recent ECJ ruling on the matter, not by shady players. As a business, technically you're simply not allowed to have dealings with US-based companies anymore if you want to be GDPR-compliant. It doesn't matter if that relation is direct or transitive. If you buy a product or service from an EU-based company, even if data on their servers is guaranteed to never physically leave the EU you're still in violation of GDPR in case that company is owned by a US-based parent company. The reason for this is that with FISA US law enforcement can force US-based companies to hand over any data, even if that data is stored with an international subsidiary under a completely different jurisdiction. Now, you might say: "See? This is GDPR working as intended." While that's technically true that doesn't take economic reality into account. It's simply not possible to have an exclusively EU-based economy. Otherwise, why would the EU even need to negotiate trade agreements with other countries (which during the Brexit debate has often been cited as one of the main benefits that comes with being an EU member)? Why do businesses even have to deal with this? This is a problem at the national and international level and it needs to be solved at that level. Why is it impossible for the EU to demand a FISA exemption for EU-based companies - US-owned or not? That's not an unreasonable demand, after all, given that FISA interferes with other jurisdictions. The reason is the EU is weak. It's far easier to bully local companies into submission than to do the right thing and stand up to the US.