I think this case is safer than the porn one, because the actual data in this case is legal in both jurisdictions, it just must not be transferred from jurisdiction US -> jurisdiction non-US, which it has not been.

I believe you're right, this is the key distinction which I missed. (Disregard my earlier email to you :) Thanks for the patient explanation. /r$