His reading of the letter of the law is probably right. Enforcement is a big question, but they'll hold their judgment given how mad they are generically at U.S. Tech cos.

Source: worked with EU regulators on privacy.