No it doesn’t! The citizenship has nothing to do with the law. It’s the residency. An EU citizen living in New York has exactly zero to do with GDPR. An American citizen living in Paris though, would be covered by the law.

However it does apply to EU companies regardless of where the data subject is, and given that Apple is clearly an EU company if you see how its business is structured to (illegally) avoid taxes[1], it would apply in both cases.

But, more importantly, the GDPR doesn't help if the data is needed for a criminal investigation. There are very clear exemptions to the GDPR protections, and this is one of them.

[1]: https://en.wikipedia.org/wiki/EU_illegal_State_aid_case_agai...

> Well, not if you're physically located in in the U.S. at the tome, but the GDPR effects non-EU businesses and governments as long as the person involved is an EU citizen.

In what court would you bring a case against the United States under the GDPR?

If the business operates with the EU, this generally involves having a subsidiary in an EU country (most companies have subsidiaries in Ireland that own all of their "IP" for tax avoidance reasons, and thus can be very trivially fined as they operate as an EU company).

I get your point, but practically most large companies have EU subsidiaries (and in many cases, structure their businesses to exploit the benefits of EU nations like Ireland) and thus must follow EU laws anyway.

I was addressing the "governments" part in

> but the GDPR effects non-EU businesses and governments

specifically.