GDPR doesn't have a citizen requirement, only residency. The word "citizen" doesn't appear in the law at all!
Art 3 of the GDPR ( https://eur-lex.europa.eu/eli/reg/2016/679/oj ) explains all. It's only when one of the person , or the company, is in the EU (or maybe EEA). So EU citizens in the USA aren't covered.
Art 3 of the GDPR ( https://eur-lex.europa.eu/eli/reg/2016/679/oj ) explains all. It's only when one of the person , or the company, is in the EU (or maybe EEA). So EU citizens in the USA aren't covered.