Like any website, we have an account system where people log in to access their orders and activate their software. So we have usernames, passwords, real names, recent IP addresses (for abuse protection), as well as the data of people's orders.
This is stored in the AWS East-1 datacenter in N. Virginia. Our users are mainly EU and US, and being in N. Virginia gives users the best overall latency.
We're about to incorporate in Europe, and I seem unable to interpret the recent rulings in any other way than that having a single account system is illegal, unless the account system in its entirety is hosted in the EU.
The engineering challenge is unfathomable, and it seems it would be for any business from a WordPress blog to a Google account system. If an EU user has a Google login, and the account system contains their first name, and Google's account system is global, how is this not just as illegal? Aren't all account systems illegal now?