Maybe it's just, that the European law makers understand the risk of being are to transfer sensitive persona data into other legislations, and that a local registered company doesn't mean there are technical bounds.