Re: "Microsoft maintains that the data is secured under EU data protection laws"
I shall save everyone the effort:
"All persons born or naturalized in the United States, and subject to the jurisdiction thereof, are citizens of the United States and of the state wherein they reside."
The phrase "and subject to the jurisdiction thereof" is not required unless there exist persons born or naturalised in the US who are not subject to the jurisdiction thereof. Therefore, far from asserting the supremacy of US law, the sentence presupposes the opposite.