They have to have a business somewhere.

For instance, if a UK citizen is concerned how their data is being processed by a USA company:

* They complain to the UK's Information Commissioner's Office (ICO) * ICO talks to their US equivalent (I want to say it's somehow the Treasury's job), on the basis of international treaties (Data Shield legislation) * That US regulator deals with the US company and imposes fines / process changes as appropriate