If it chooses to move that data elsewhere, that is its choice, and also liability if moving that data runs afoul of regulations in the original country. The foreign country itself doesn't really matter, the entity is doing business in the original country, and would be held liable there by its users/business partners according to local laws.
>The foreign country itself doesn't really matter
Of course it matters. Every country has legal differences on the definition of privacy and associated liabilities (if there any at all). In addition, it's unlikely that one country can establish jurisdiction over data in a foreign country without violating national sovereignty. Arguing that doing business establishes a legal nexus with someone of a particular citizenship opens up a massive can of worms about whose law applies where.
Data is generated in the location where a human user interacts with the system, whether that be with a fully local system, some random website with a server in who-knows-where, or just configuring a domain for e-mail.
(Yes, AI actions are a separate can of worms.)
> > The foreign country itself doesn't really matter
> Of course it matters.
It doesn't for suing for rights, that's the point of generation-based legal authority. The legal transaction is taking place in the user's location, and by offering services there, you are agreeing to the local legal framework.
> Arguing that doing business establishes a legal nexus with someone of a particular citizenship opens up a massive can of worms about whose law applies where.
This is already the case, except with location and not citizenship. Safe harbor agreements just used to make this much less of an issue until they disappeared. You really can't expect to do business somewhere without adhering to the local legal framework.
I'd like to add/clarify/point out that there's two very different kinds of law/policy nations can go for here:
1. passing requirements that anyone processing data needs to meet some set of guarantees, e.g. privacy (including against state actors, e.g. CIA/NSA), cyberbullying handling, or copyright enforcement. This also includes (the absence of) safe harbor agreements.
2. passing requirements that data processing happen in a particular place, regardless of intent (could be in the belief that place X provides better privacy guarantees, could be because place X can censor/control data)
The latter doesn't solve anything from the citizen's perspective, even if that's the intention. But it does address the issue of "invading Sweden".
I personally consider the former much more important, but the latter is sometimes necessary too. But they need to be clearly identified in discussion. They are not interchangeable and sometimes issues better addressed by one are used to try to argue the other.