Re: Pointless
The central problem is that GDPR places obligations on anyone collecting or processing personal data which still apply if you send the data for storage or processing in another jurisdiction. If you send it for processing in another jurisdiction you need to ensure that the legislation of that country allows for those obligations to be met.
The legislation in the US fails that test. There have been attempted fudges in the form of Safe Harbour and the Privacy Figleaf with its Standard Clauses. All have failed when taken before a the ECJ. What seems to keep happening is that further fudges get offered but because the US legislation hasn't changed it's difficult to see how they could work there. AIUI what seems to be happening now is that firms are being advised to look at a business with different countries on a case-by-case basis.
The above ignores the effect of Brexit. It still applies to the EU. We now have the situation that the UK courts make the determinations for the UK. As the current UK legislation is the same as when we were in the EU a first assumption is that the UK courts would reach the same conclusion on the same facts s the ECJ. We then have to consider the consequences of either (a) the courts reach a different conclusion or (b) HMG passes a new, weaker DPA or other legislation that weakens its effects (to the detriment of the privacy of UK residents, of course).
Whilst the UK is following the same rules as the EU in the same way there should be no problem in a UK company collecting or processing data of EU residents. This facilitates UK businesses who wish to offer services to individual customers in the EU. If, however, the UK changes that then it may be in breach of GDPR in respect of such customers. Also, if a UK business were offering data processing services to EU companies then for those companies the risk assessments advised in the article would apply.