"Data collected in Europe shall be processed generally in accordance with the legal provisions of the country in which the data was collected, regardless of where the data is processed, but at the very least in accordance with the requirements of these Binding Corporate Rules Privacy."
His data wasn't collected in Europe.
" For Deutsche Telekom AG from July 01, 2014 in accordance with approval by the Board of Management on June 10, 2014. In the domestic Group companies, as per board approval or decision of the responsible board member."
Where's the board approval of the US board?
How about the GDPR?
" The whole point of the GDPR is to protect data belonging to EU citizens and residents. The law, therefore, applies to organizations that handle such data whether they are EU-based organizations or not, known as “extra-territorial effect.”" (gdpr.eu)
Is he an EU citizen?