Needless to say, non-compliance is not a real option for most banks, given the importance of the US in the banking sector, so they're essentially being blackmailed into compliance.
(Unfortunately for US expats, some foreign banks figured out that the easiest way to be compliant was simply to get rid of their US customers.)
Of course this was pushed through by US lobbyists and, you guessed it, that's where the money goes as well.
You can be certain that some (local) politicians got some kick-backs out of it.
There is also the impact of PATRIOT section 215 and FISA, which requires some foreign companies to ensure that some sensitive data is not stored on devices operated by American companies.
https://calvinayre.com/2016/11/28/business/antigua-warn-amer...
Net Neutrality https://www.theverge.com/2017/11/23/16693840/net-neutrality-...
Are the two immediate ones that come to mind.
However, recital 23 makes it clear that you do not need to comply with GDPR unless ”it is apparent that [you] envisage offering services to data subjects in one or more Member States in the Union”. In other words, it’s not your fault if you are a US-based site and it goes viral in the EU unless it was targeted to them.
Don’t translate to EU only languages, mention EU users or customers, or use an EU-based domain extension. You can also announce your intention to not serve EU customers by blocking EU visitors. Even though some EU traffic may get to your site through VPNs etc, merely trying to block them is more than enough to show that you do not “envisage” serving EU customers, which makes you not subject to GDPR. Those EU users that evade your block through technical means are not subject to the protections of the GDPR.
Finally, one law firm suggested that we put a checkbox similar to this on our registration forms:
”This website was designed to comply with US privacy laws. By checking this box, you attest that you are NOT subject to any law or regulation that conflicts with or is more restrictive than US privacy laws, including but not limited to the GDPR.”
Can they (ads provider) sue you? And if they do, even if you are not guilty, how much money would it cost to win at the court?
When looking at whether an action can proceed under the GDPR (either against you or an ad network whose code you have on your site), their regulators will review your site and see that the checkbox was required to register. That, combined with not having content or services targeted to EU users, should stop any GDPR action in its tracks before it is filed.
This of course all depends on the GDPR being enforced in good faith. They have every incentive to be abusive with it, and no incentive not to be. But we just have to hope that newly self-declared privacy overlords in the EU are kind and benevolent.
Here's a random and perhaps unfounded thought that I've had a couple of times regarding this line of thought re: GDPR.
What to stop some foreign bad actors from abusing the hell out of this legislation and burning up more useful time and energy on it? Moving beyond that, it would very likely serve to further divide and erode the trust between the EU and the US.
For example, if we're to assume that Russia is seriously meddling in everything that they currently stand accused of meddling in, essentially engaging in some loose, and seemingly effective (depending on who you ask), forms of cyber warfare, then what is to stop them from turning this regulation in to a complete nightmare for US/EU relations and further driving us away from our common goals?
It just seems to me that these sorts of good faith and intentions based laws don't work as effectively in the modern era as they maybe once did.
edit/ It honestly doesn't even need to be so malicious. I could imagine trolls causing more than enough trouble for small businesses just for the lulz.
Nothing, and in fact it incentivizes each of the 28 countries to act in bad faith. The crippling fines authorized by GDPR have the potential to both create enormous revenue streams and hobble foreign competitors of local companies. GDPR advocates say this won’t happen, but there is nothing to stop it.
You mean more than all the leaks of EU data by US companies that go unpunished because of loose/nonexistent US privacy laws?
The ICO put a market of live human organs as example.
In same manner, even if I would click that I agree, that your site is designed for US privacy laws and not for people under GDPR protection, it would be the same as you would warn me, that I will be your slave before signing and that I can just walk away and don't take the car. But if I take the car, the contract would still be void. I don't think that this would fly.
The problem is not in the GDPR requirements but rather in right to privacy as fundamental human right and GDPR is just an advice how to respect it - it is actually a free help.
What you want to avoid is something much bigger than the checkbox on your site or ip blocking, check here "The Bill of Rights":
https://en.wikipedia.org/wiki/Fundamental_rights
This is something you shouldn't even think to violate, not to EU or US users. Or anyone else.
It doesn’t force them to do anything, nor does it ask them to waive any of their rights (which is often illegal and/or unenforceable). Instead, it asks them to certify that they are not subject to laws more restrictive than those in the US. If they are, they are not allowed to register. As the site owner, you have a legal right to rely on your users not lying to you. Your slavery example is an entirely different scenario - you are asking people to waive rights they have (to not be a slave in this case). That’s not what this checkbox says.
The main point of the checkbox is to signify your intention to not offer services to people subject to the GDPR or other restrictive laws. We have been advised (by actual attorneys) that this should meet the standard built into the GDPR that we do not “envisage” the offering of goods or services to those subject to it.
I think that at the end, world will be better place due to GDPR, but there is surely some rough ride ahead - not due to respect of privacy but due to violating it so often that it became normal to us.
I think that much greater threat is comming from a direction of US companies you use than from EU courts this (again, might) become another "patent trolling"-like action from some US companies.
For most of the world, this has been true in regards to following US laws for a long time. (DMCA, copyright law)
In the end, international law is mostly a game of (economic) influence, and the EU is economically significant enough for these companies for EU law to matter.
Let's not pretend that the US is unilaterally shoving copyright law onto the rest of the world. When the US made its last major overhaul of the copyright system, it was to harmonize copyright law with what already existed in Europe. In addition, the EU already signed onto the TTIP, which is a massive concession to the media industry on copyright. That wasn't due to US influence; in fact, the US backed out of the TPP.
TTIP was NOT signed into law already. It is also a completely different treaty from TTP. (TTP has nothing to do with the EU btw).
TTIP hasn't been signed into law, but it's been written by EU member states to serve EU members' interests, so it's pretty reasonable to use it as a measure of what the EU wants.
TPP is a different treaty from the TTIP, though not very - the TPP and TTIP were written in tandem to be companion agreements, and the TPP contains many provisions that were explicitly included as concessions to the interests of EU states, even though they're not parties to the TPP itself.
There is no world police enforcing laws in every country. It all boils down to a monopoly on violence and if a country can't physically get to you or your stuff you can tell them to fuck off all day
Edit for clarity
If such a fine is levied, but the company is based in China, does China have any treaties with the EU demanding the fine be enforced, or can they tell the EU to go pound sand?
[1] http://www.wechat.com/mobile/htdocs/en/cookies_policy.html
And, you don't have to abide by foreign laws as long as you never intend to go into that country or do business with people in that country. But, as many EU companies are about to find out, they're subject to US laws, most notably those pertaining to sanctions on Iran. So why shouldn't US companies be subject to EU laws?