That's a feature, not a bug. It means you don't get to use personal information for marketing purposes unless the customer really wants to to and says so. It's the customer's information, not the retailers.
US businesses might think of it as the customer having a property right, like copyright, in their own personal info.
I consider not being able to run an otherwise reasonable business at all a bug.
It means you don't get to use personal information for marketing purposes unless the customer really wants to to and says so.
It also means, for example, that you can't charge them using a US-based payment service, provide whatever product or service they are requesting if it involves interacting with a US supplier and providing their personal details for delivery or authorising access, or use US-based administrative services to help run your business more efficiently, without your customers' explicit consent, even if this is only to provide exactly what they've just asked you to provide.
This is question begging. If your business model depends on openly breaking the law, it's not a reasonable business model.
If the end of slavery causes your cotton business to become unprofitable, it's not an attack on the cotton industry, it's still an attack on slavery.
Alternative possibility: The law is broken.
What if your business model is otherwise perfectly reasonable and acceptable to all of your customers, and it doesn't rely on breaking the law at all, until the very governments who are entrusted with producing reasonable, consistent laws to support their populations are the ones who screw it up? Should we just close down all European companies doing business with US online services right now, today?
As far as I can see, that is technically what this ruling will lead to. Somehow, I don't think most people in either Europe or the US would consider the resulting collapse of both regions' economies to be desirable, and I doubt that was the desired outcome when the European lawmakers established the basic data protection principles at the heart of this. Those same lawmakers, after all, are the ones who saw fit to provide a Safe Harbor mechanism to facilitate reasonable international trade in the first place.
If the end of slavery causes your cotton business to become unprofitable, it's not an attack on the cotton industry, it's still an attack on slavery.
And what about providing exactly the service your customers were asking for, but using say a US-based payment service that is openly disclosed in your privacy policy? Maybe that is now illegal on a technicality, because you didn't get active consent for using that US service to charge their card. What if your Europe-based bank didn't have explicit permission from your customer to communicate with a US-based card scheme to authorise your customer's card, for that matter?
Will it really help to confront customers with yet more mandatory legalese at the online checkout that just describes what everyone expects to be happening anyway? Who is really going to benefit from that? I'm all for reasonable protection of personal data and proper safeguards for privacy, but when you go so far that you stop people transferring personal data in ways that are necessary to provide the exact product or service that a customer is deliberately requesting and would be reasonably expected by that customer, you've lost the plot and your system needs fixing.
It's really not that simple either. Many businesses, particularly very small ones, depend on external services to be viable in the first place. It's right that those businesses should pay attention to data protection and privacy issues -- I'm a strong believer in such things personally -- but there also has to be some reasonable framework for what can and can't be done by default, without requiring explicit consent for every last detail.
The trouble with opt-ins for everything is that it instantly scales beyond the point of being practical. Just as hardly anyone actually reads the 9,753 page terms and conditions document before checking the box or pays any attention to the "we use cookies" notices, so hardly anyone will pay attention to formulaic "we might export your data outside the EU and foreign governments might spy on you" warnings. Creating a system that no basically reasonable and ethical business can actually comply with in practice will just result in no-one taking the rules seriously and consequently no-one actually enforcing them, again much like the cookie notices and so on.
Ironically, a good solution in this case is easy to see: the US government could make it absolutely clear that interception of or interference with personal data held by US companies can only be done following proper, legal processes, and then the EU governments would need to update the rules about Safe Harbor provisions to allow a reasonable exception for government access to personal data following due process. Throw in mandatory encryption at a level where the shortest path to getting data needed for legitimate government purposes is to just get the appropriate warrant or equivalent and formally request that the business in question hand over the relevant data, and probably most people are happy.
No-one serious about the privacy debate seems to be suggesting that businesses should never have to turn over personal data they have access to in order to comply with something like a proper court order to provide evidence for a case being heard by that court. It's the dubious access to the data outside of proper legal processes and oversight that causes the conflict here, and at least parts of the EU government system take that sort of thing a lot more seriously than most of the US government right now.