Step 1: Declare yourself the lawful sovereign of your citizens in customary international law and be accepted as that both internally and globally.
Step 2: Define a fundamental (constitutional) human right to data privacy, see charta of fundamental rights of the European Union Article 8
Step 3: Create regulations that define how to lawfully handle the data of european citizens (-> GDPR, Police Directive, ...) and what happens if one disregards the fundamental right.
Honestly the whole thing becomes much easier to understand if one substitutes any other fundamental right, like the right to bodily integrity. A foreign corporation is not allowed to harvests our citizens organs without lawful basis (like written consent), even if it claims the law of its home country allows it to harvest organs as it pleases.
Step 1: Declare yourself the lawful sovereign of your citizens in customary international law and be accepted as that both internally and globally.
Step 2: Define a fundamental (constitutional) human right to data privacy, see charta of fundamental rights of the European Union Article 8
Step 3: Create regulations that define how to lawfully handle the data of european citizens (-> GDPR, Police Directive, ...) and what happens if one disregards the fundamental right.
Honestly the whole thing becomes much easier to understand if one substitutes any other fundamental right, like the right to bodily integrity. A foreign corporation is not allowed to harvests our citizens organs without lawful basis (like written consent), even if it claims the law of its home country allows it to harvest organs as it pleases.