Foreign regulators' data requests put companies in a legal bind