Reply to post:

""That's because the recipient of the email - in this case you - export the data to a third party without the sender's permission."

Actually, this one doesn't fly. The sender of the email exported his own data."

I'm pretty sure you can't be right on that one. If I e-mail a company in the EU, I have a reasonable expectation that that data stays inside the EU. If the receiving company sets up automatic redirecting that shunts that e-mail to the US, then the recipient has done that, not the sender. You cannot say that the sender broke the law when they have no knowledge that the recipient has set up automatic forwarding.

If the recipient wants to avoid breaking the law, they have to, for all new addresses e-mailling them, set up an automatic bounceback with words like "This address forwards data outside of the EU. If you consent to this, please resend your message." The alternative is not to automatically redirect their e-mail outside of the EU and, you know, obey the law.

And if anyone says that e-mail doesn't work like that, it kind of doesn't matter. The law says it must, and if you don't want to break the law, stop sending e-mails. You can then complain to the legislature, but you still cannot break the law in the meantime.