I see your point, but the reality is different. Data stored is not data in transit. Both must be protected, but the attacker models are different. Unfortunatel

I see your point, but the reality is different. Data stored is not data in transit. Both must be protected, but the attacker models are different. Unfortunately real-world (meaning, not theoretical) encryption is not perfect, thus the sole fact to encrypt is not sufficient to let you store any data wherever you want. At least not in Germany, and at least not from my pov. To remain in topic with this specific law, data in transit can exit Germany soil, provided that the recipient gives guarantees on its usage (including not store it). This kind of laws should be seen to regulate sensitive (user) data as managed by (big, multinational) organizations, that are thus required to enforce security for both stored and in transit data. I understand that this may seem silly, but without such laws the landscape would be way worse (consider, e.g., how many personal data are actually traded across the world for ads reasons).