"he has to show firstly that he had a reasonable expectation the data would be stored/processed in the EU, and then secondly, that the data was transferred outside the EU without his permission?"
No not really. EU law allows transfer to US if US offers equivalent protection to EU. FB taking data to US, saying US offers equal protection when clearly US does not protect privacy at all,let alone to EU-required standard. So, in EU at least, he has a case.
Biting the hand that feeds IT
