For the rest of your life? Source please?
You can be put temporarily into a cell for plenty of stuff but that's temporary. A fine is pretty permanent and when it can be millions, well that's probably the end of your business too.
> There's nothing that says IRS won't prosecute you if someone buys you a soda and you don't declare it as income.
Isn't it simply paying back what you should have + interest? (with some threshold)
Paying taxes is already part of the cost of running a business too (and that's a pretty low cost for a startup, versus having an actual trained DPO).
> Or that you won't be prosecuted by someone in the US if your blog has a copyrighted image and you don't receive a DMCA request that was sent to you.
Which is exactly why you try not to put copyrighted image over your website. Most of the times PII isn't something you can just avoid for a business.
> All fines can be administratively and judicially appealed.
Any appeal represents a cost. A cost that you can't always support until the end.
At the end, it's all about the cost of the risk... that's it. GDPR seems a pretty high cost.
The tax laws are vastly more complex than GDPR. The maximum penalties for tax fraud seem to be $250,000 + cost of prosecution + 5 years in jail.
If you make a small mistake on your taxes, and the IRS notices, you will probably receive a warning and have to repay it with interest. If you make a negligent mistake, you may be in addition be fined a small percentage, like 10-20%, of the amount you failed to declare. You have to conduct very large scale and intentional tax evasion for the maximum penalties to apply.
The IRS could argue for and try to apply the maximum penalties for a lemonade stand, but they don't. And people go on with their lives, put in their best effort to comply, and can be confident that they will be treated fairly.
The guy committed an "US crime" in Russia, where what he did was not illegal. He arrived on US soil, where he committed no crime.
He was still arrested and charged.
It's not like if the US laws didn't have any extraterritoriality.
This is a disingenuous argument. The US has never passed a law that is this easy to violate outside of its own borders, is this ripe for abuse, and carries such enormous penalties and burdens for essentially everyone in the world that wants to operate a website. In fact, no country has ever done this before.
GDPR is different, and not in a good way.
The US has clearly passed many laws that meet all those criteria but the last (and with much harsher, often criminal rather than merely financial, penalties), so unless you believe that operating a website is somehow a unique class of activity deserving special protection from extraterritorial application of laws, this is a pointless comparison.
And there's actually a number of US laws affecting website operators that arguably meet all three criteria, as other comments point out.
The US has a law requiring US citizens living and working outside of the US to file taxes in the US. Not doing that is a crime. You'll probably argue that this is different, since it concerns American citizens, but it isn't different, because it's a US law that is very easy to violate outside of its borders.
GDPR is not a money making mechanism but a way of forcing compliance. I think that's the difference that many US people don't seem to understand.
Also I was responding to the comment that the US has never done anything like this, which is completely false, US people tend to forget what it's like for the rest of the world.
There's nothing that says IRS won't prosecute you if someone buys you a soda and you don't declare it as income.
Or that you won't be prosecuted by someone in the US if your blog has a copyrighted image and you don't receive a DMCA request that was sent to you.
See how ridiculous that sounds?
All fines can be administratively and judicially appealed.