Europe claims that the GDPR applies to data stored outside Europe, USA claims that their search warrants apply to data stored outside the USA. Seems pretty symmetrical to me.
US search warrants on the other hand basically circumvent local law. I, as an Austrian Citizen, have no way to protect myself against such warrants if I decide to put my data in, let’s say, office365, even if the physical location of my data is within Europe and the actual operation of the Servers is handled by a different, European company.
In my opinion, this is nuts. The US should have to go through the same channels for foreign police assistance as everybody else.
What are they even legally able to do if you, as a US company, simply refuse whatever the EU asks.
Absolutely nothing is my (IANAL) bet. If you're not physically in the EU, I have a very hard time believing any US court would allow you be... extradited? Or even enforce fines from a foreign government.
Then again, maybe I'm totally wrong and am just confused about how EU law can regulate those not under their jurisdiction.
Obviously it would be much easier to enforce against companies that do have some presence in the EU.
I have had good expierience with Hetzner (germany-based), but all you get is cloud vps boxes and storage.
So Office365 is owned by an American company, which the US has full jurisdiction over. If you don't want to deal with American laws, then don't deal with American companies. But given that American companies basically set the standard for computing, good luck.