Because American-based data
processors cannot guarantee that data will not be subject to US surveillance. The US does not provide EU residents with the level of protection that GDPR requires.