The European Court of Justice ruled that an internet-based company which specifically markets to any particular country and has operates in that country must follow that country's data protection rules for citizens of that country.

This decision looks correct to me. The multinational Companies should not be able to shop around between countries for the weakest data protection and apply that to everyone. Meanwhile, smaller companies that operate in one country will still be covered only by that country's law, even though they sell to people in other countries.