> the transfer may not be lawful
Lawful under whose law? It's legally required by CLOUD act, so mandatory under American law. This is the long arm of Europe just as much as America.
You could have a company based and hosted in Belize that stores data about a European who committed a crime in America. America can demand that data under her law; Europe can demand it deleted under hers. Who is right?
This is the making of both entities, not just America, unless there is some legal reason that the European law ought to take precedent. It's pretty clear what to do if you're incorporated in Europe or America; you follow the law of your base of operations. For multinationals or corporations alien to both, however, there's a dilemma.
In other words, your moral favor towards GDPR doesn't make it more legally important than CLOUD, nor vice-versa. Both are just as significant for an alien company or for a multinational.
Lawful under whose law? It's legally required by CLOUD act, so mandatory under American law. This is the long arm of Europe just as much as America.
You could have a company based and hosted in Belize that stores data about a European who committed a crime in America. America can demand that data under her law; Europe can demand it deleted under hers. Who is right?
This is the making of both entities, not just America, unless there is some legal reason that the European law ought to take precedent. It's pretty clear what to do if you're incorporated in Europe or America; you follow the law of your base of operations. For multinationals or corporations alien to both, however, there's a dilemma.
In other words, your moral favor towards GDPR doesn't make it more legally important than CLOUD, nor vice-versa. Both are just as significant for an alien company or for a multinational.