You were certainly right (and still are, depending on how you read your comment). I'm not a lawyer, but I believe that Safe Harbor is no longer safe to rely on (since a 2015 ruling). There's Privacy Shield and the soon to come into force GDPR, though, which have restrictions like the one you mention.