Why do you think privacy is not involved? Currently if a US company stores data on EU citizens then the US government can compel them to produce that data in a way that's not compliant with GDPR. That seems to be a pretty unambiguous privacy issue (not arguing that there are probably some other politics going on of course).