like most EU law it's badly written, but it states "to such data subjects in the Union"

given "within the Union" is used separately in the next sub-article to mean physically located within, it's arguable that "in the Union" could mean citizen of