Privacy in the EU and American companies Politics and governments

What do you all think about GDPR? Do you feel like it does enough to protect privacy on the Internet? HOw do you feel about the fact that American megacorporations like Google and Facebook can circumvent (bypass) these laws?

I think the discussion should be divided into 2 separate subjects: corporations, and national interest.

Corporations: On paper I think GDPR is enough. It forces companies to handle personal data in a responsible way (in terms of collecting, storing, and processing personal information) and forces them to disclose what they do. Users also have the ability to request permanent data deletion, which is huge.

National interest: I believe a major step forward would be for countries to require corporations to host data on their respective soils. Virtually all big companies (except globally known Penpal-Gate 😛) hold their data in the US. It has been shown countless times that the US govt can force any company to give up their users' data while also issuing gag orders to top it all off.

I put the topics together because I wanted to be super specific, I guess you could say that I really wanted to reduce the amount of ambiguity here!

Oh yeah, I"m aware of the US stuff, I don't know if there's much that can be done with the international law to prevent the US from doing gag orders or forcing them to give up data. I ask because a commonly cited as limitation of GDPR is having to deal with Facebook and Google.