The core of the issue is the CLOUD Act, which was passed very recently -specifically to force US tech companies to comply with subpoenas on data stored in the E

The core of the issue is the CLOUD Act, which was passed very recently -specifically to force US tech companies to comply with subpoenas on data stored in the EU. This is basically the Hague Invasion Act[0] for data privacy. It commandeers nominally private US tech companies into arms of US law enforcement for crimes committed in EU territory. The non-US citizens thing is a related issue[1], but it's not what started this current row of GDPR export lawsuits. However, I don't see the EU courts letting this go until and unless the US and friends drop the whole "noncitizens don't have rights" shenaniganery. [0] https://en.wikipedia.org/wiki/American_Service-Members%27_Protection_Act https://en.wikipedia.org/wiki/American_Service-Members%27_Pr... [1] Five Eyes - effectively the Anglosphere's spymasters - realized that if you say "only citizens are protected by privacy law", then nobody is protected by privacy law, because you can hire your allies to infringe upon your own citizens' privacy.