The most important point here is that the company that originally collected the data isn't that relevant. If other laws don't support privacy protection, you must assume your data may end up just about anywhere & everywhere.
We do have laws that support privacy protection around here, and I still assume it may end up just about anywhere. Data is just too easy to copy around. What these laws give me is the power to tell those companies to delete it, and to get our National Commission for Data Protection to fine them if I ever get evidence that they didn't.
But I would never assume the data is actually protected.
