It never was about "where it is processed" but "who can access it".
I assume here the EU can't do the same?