On Flaw No. 5: Dismissive treatment of jurisdictional norms... I like this, it's a feature not a bug. Why: First, because it's pretty standard for many count

On Flaw No. 5: Dismissive treatment of jurisdictional norms... I like this, it's a feature not a bug. Why: First, because it's pretty standard for many countries to try to enforce the law beyond it's own borders. The US is particularly (in)famous for this but others do it as well. Why should the EU be an exception? And you are free not to, just don't process the information of EU citizens. And if you do fuck it up, that's ok too because GDPR is aimed at organisations. It has no ability to extradite and imprison people. Second, information knows no borders. It is actually quite hard to tell where information is actually being stored. Just look at the struggles around cloud providers assuring data is NOT transferred internationally. So a GDPR that only applied within the EU geographical borders would be useless: bad actors abroad would continue to abuse the rights of EU citizens. And worse: People might actively transfer data OUT of the EU purely to misuse it with impunity. That would both defeat GDPR AND punish good actors.