Extraterritorial Impact in Data Protection Law through an EU Law Lens