you misunderstood. it can be argued that once YC has established a sufficient nexus within a particular country it can be held to its laws (in this case, DE data protection and privacy laws which are far stricter than those of NL, afaik).
on a much larger scale, watch for the impending fight between the EU commission and facebook about this very issue.