Actually Mr. Internet troll.
The precise question of law is “Does the EU GDPR allow non-EU residents to invoke a GDPR request on Amazon?”
If we look at your post you plainly EU GDPR will apply “where it processes the data of people in EU”.
If you look at the example provided it states the regulations will apply where" . . .a company established outside the EU and is offering goods/services (paid or for free) or is monitoring the behaviour of individuals in the EU."
Further if you read the example provided it states the regulations will apply where the company is " . . . established outside the EU." but “. . . targets mainly Spanish and Portuguese language universities in the EU”
Here is Art. 13 of the GDPR which relates to the information an entity subject to the EU GDPR must provide to a person when requested.
Here is Art. 15 of the GDPR which provides you with a right of access.
The definition of a data subject which means “an identified or identifiable natural person” Art.4(1).
With regard to a data subject, Recital 14 of the EU GDPR makes clear that “the protection afforded by this Regulation should apply to natural persons, whatever their nationality or place of residence, in relation to the processing of their personal data.”
Lastly, Art.3 which basically restates your link.
Here, because AGS is offering a service to EU residents, AGS must comply with the EU GDPR requirements on data processing, privacy and access to data (as linked above). This is because AGS (i) is a foreign entity, (ii) offers services (i.e. a video game) to EU residents (both inside and outside the EU) and (iii) monitors the behavior (i.e. telemetry data, usage statistics etc… while using New World) of residents inside and outside the EU.
Accordingly, where an EU resident is playing on a US region server hosted by AGS, Seattle (for the sake of argument) then AGS, Seattle must comply with EU GDPR requirements on access to data and personal privacy, regardless of (i) there being US residents on the server; (ii) the server being located in the US; (iii) the company’s domicile (i.e. where the company is located).
Indeed, because AGS processes the personal data of data subjects in the EU, and EU Citizens located outside the EU, AGS is required to comply with EU GDPR obligations and you are entitled to invoke your rights under the law.
In addition to the above, and taking into account Recital 14, the regulation makes clear the the scope of the regulation applies to any natural persons (i.e. not a body corporate; i.e. not a company) “whatever their nationality . . .”. This theory is further supported by Recital 1 which sets out data protection as a “fundamental right”.
Therefore, because AGS is subject to the EUGDPR (by virtue of processing the data of EU Residents) and because the EUGDPR has been interpreted to apply to any ‘natural persons’ without regard to their nationality then it necessarily follows that a US citizen, residing in the US, playing on a US server can indeed invoke the EUGDPR for access to data.
And if we want to get super nitpicky by the way, most mega-conglomerates and financial institutions like Amazon, AGS, J&J, Proctor & Gamble, Unilever, JP Morgan, BoFA or any other listed company bake the EUGDPR into their privacy policies to avoid liability for being out of compliance with the regs.
