The 28-nation bloc must defer to this new benchmark when dealing with issues of data privacy on the borderless internet.