The companies that are most guilty of mishandling personal user data are American companies. If it could not apply to them in protection of EU citizens any regulation would be useless.