Nitpick: The GDPR says it applies to persons who are "in the Union", which seems it would cover non-citizens who reside in (or are even just visiting) the EU, and would not cover EU citizens who are not in the Union.
Yeah, re-reading I should have used "persons" rather than "citizens"; was playing a fast and loose with the meaning of "citizen" and didn't actually mean a "citizen of".
