1. It applies to everyone, with no thought of company residency or size.
2. It applies to all forms of "personal information" and "processing," defined ridiculously broadly.
This means that the following things are technically illegal by the text of the law:
* Storing the email address of an EU-based customer of your consulting shop on a private server not in the EU, and (God forbid) using it to send a sales email to that person.
* Storing the IP address of an abusive user of a SaaS website (in order to block them) if that user happens to be in the EU and your server is not.
Should these be illegal?
I have no problem with the GDPR that you wish you had, by the way. My problem is with the one that exists. It neither stops the wholesale harvesting of information nor actually benefits privacy.
This is precious! The US has imposed their views on the internet for the past 30 years. How is GDPR unique? The difference is once again that GDPR is favorable to EU citizens (because yeah, GDPR only applies to EU citizens) and your laws (Cloud Act, DMCA, and basically all your copyright laws that stole us our fair use rights and allow for tech behemoths to grow and exist) just favor big companies, and only them. Don’t confuse freedom and extreme liberalism.
> Europe as a whole has given up the freedom to "start up" without compliance with a huge number of rules and regulations
Yes. This is a good thing. The end doesn’t justify the means. We still have unicorns and well doing companies.
> notice how I didn't mention privacy or user security).
Well, your mistake.