It applies to Europeans, even if they're not in Europe, and even if they don't identify themselves as being in Europe.

How exactly does the EU propose to apply its laws to people dealing with Europeans outside the EU?

Being European doesn't automatically subject everyone you interact with to EU laws, especially while you're outside the EU.

> How exactly does the EU propose to apply its laws to people dealing with Europeans outside the EU?

The EU can seize hard- and software of Facebook on their EU servers, the EU can seize Facebooks cash holdings in Ireland, the EU can seize (and sell off) Facebook’s patents held in the EU.

Stuff like this has happened before, and european governments have previously even seized airplanes from airlines right after landing to pay customers for a refund for a flight that the airline refused to pay.

This can, and absolutely will happen.

USA appear to have pushed their laws outside their natural jurisdiction ....

I think in practice it will mean Facebook, say, can't suddenly breach the normal EU regulations just because you went on a trip outside the EU.

To correct your correction I'd like to add that far from every European country is a member of the EU.

He is saying that that law applies to EU citizens even when they are not located in the EU. Much more difficult then determining which country the user is connecting from.

Not sure if this is the law though

And UK citizens, even if Brexit happens.

Or indeed care about the law enough to bother before they're fined for doing it. After all you'll need to prove they didn't delete the data first!

The GDPR penalties can reach 4% global (i.e. sum all related companies) annual turnover per infraction. If anyone ever found out Facebook had a widespread violation, Facebook would be likely be dissolved.

Oh boy would I be thrilled if that happens.

Nothing of value will really be lost, replacements would spring up super quickly and I'd like to think that we would have learned enough about the downsides of the current social-network systems for the next generation to avoid the pitfalls and hopefully make something much better.

I wish US corporate laws had teeth, it's only the criminal ones that apply to every day citizens that do.

Are there any instances of otherwise financially sound major global corporations being dissolved as a result of EU fines / regulatory action? I suspect if the rubber hits the road in this situation, FB would prevail.

Not dissolved, but the EU have shown themselves to be willing to tackle the tech behemoths, as Google recently found with their EUR2.4Bn fine https://www.theguardian.com/business/2017/jun/27/google-brac...

That's insane. What's a "single" infraction? It doesn't distinguish between revenue and profit? 4% of global revenue could be more than the total of all profit and salaries.

> 4% of global revenue could be more than the total of all profit and salaries.

That’s the point. Google recently came of comparatively well with a 4 billion EUR fine, but 2 more fines of the same height for Google are expected.

The only way to force a company to follow a law is to make infringing the law more expensive than any profit you could ever dream of making from it.

"Profit" can be kept at zero essentially forever. Revenue is much harder to hide.

> What's a "single" infraction?

There are lots of things that constitute an infraction: the GDPR aims to broadly protect EU citizen rights. Some infractions can be per individual harmed.

Then they better do their best not to infringe the privacy rights of EU citizens then, eh?

Yes.

And European courts consider intent carefully. Mere aggregation of personal data isn’t necessarily a violation, but using it commercially almost certainly is.

Someone in Europe should make a privacy complaint just to keep them on their toes.

You mean to step on their toes.