I think this should be regulated by the https://en.wikipedia.org/wiki/International_Safe_Harbor_Priv... , basically US companies must certify themselves by the stricter EU laws... But I'm not sure if this is mandatory.