You’re right, I described it incorrectly. GDPR applies to “subjects (natural persons) within the Union”. As an example, EU citizens living abroad are not covered by GDPR. Americans visiting HN from the Bay Area also shouldn’t expect to have the rights that GDPR grants to subjects within the Union, right?