US law can apply anywhere in the world, so long as a technology company has control over foreign data, a court rules.