I’m sure in some countries that would make them liable. It’s a shame the US probably isn’t one of them, our litigative culture would put an end to that stupidity very quickly.
https://ec.europa.eu/info/law/law-topic/data-protection/refo...
I don't think it applies to EU citizens overseas IMO. At least I haven't signed up for anything that asked if I was an EU citizen or not.
Would get really messy because there are lots of EU citizens out there that don't know it through jus sanguinis.
Meanwhile a lot of financial institutions do ask if you're a US citizen because it ups their reporting requirements.