Forget all the stuff out there that says the GDPR protects EU citizens. This is a question of jurisdiction and enforcement. Say I run a blog under a business registered in the US funded by advertisers in the US. A EU citizen that comments on posts issues a GDPR request that I ignore. Their government fines me. I tell them to get bent, I am out of their jurisdiction. What can they do at that point?
No he didn’t. The context was “as a US citizen” per the post. You gave him a 6th grade civics lesson about how bills turn into laws a-la school house rock before even sort of addressing the question. The next step would’ve been explaining what laws even are.
That’s a little condescending, assuming a citizen of a nation doesn’t know how their own laws are created. It isn’t a LOT condescending but it is a little.