For GDPR, it does not matter where a company is headquartered. GDPR applies to EU citizens (users, customers). That's why big companies often comply with GDPR f

For GDPR, it does not matter where a company is headquartered. GDPR applies to EU citizens (users, customers). That's why big companies often comply with GDPR for EU citizens but completely ignore it for people outside. It would be interesting to see if that's the case for T-Mobile. If the leak exposes GDPR violations, fines will most likely follow.