And the EU tries to apply it to local subsidiaries if those are "main establishments" of data processing. There is a provision on finding the main establishment

And the EU tries to apply it to local subsidiaries if those are "main establishments" of data processing. There is a provision on finding the main establishment to avoid loopholes where local subsidiaries in the Union could hide the main company behind a legal entity in the Union (as was the case with Google LLC when they got fined by CNIL). Japanese courts not having this provision is a major drawback, which I don't believe they would leave open. Relevant GDPR regulation: > Article 4(16) of the GDPR states that ‘main establishment’ means: > - as regards a controller with establishments in more than one Member State, the place of its central administration in the Union, unless the decisions on the purposes and means of the processing of personal data are taken in another establishment of the controller in the Union and the latter establishment has the power to have such decisions implemented, in which case the establishment having taken such decisions is to be considered to be the main establishment; > - as regards a processor with establishments in more than one Member State, the place of its central administration in the Union, or, if the processor has no central administration in the Union, the establishment of the processor in the Union where the main processing activities in the context of the activities of an establishment of the processor take place to the extent that the processor is subject to specific obligations under this Regulation; Keep hating the EU, US and so on but your local place has very similar provisions around data privacy and it's considered almost completely aligned with GDPR.