That appears to be a baseless comment.

> It's a protectionist law

Or another way to look at it the US tech sector is no longer going to pick and choose which of our laws apply to it.

I'm intrigued. How is it baseless to say that a given EU country, say Germany, would not see a massive inflow of foreign money and a bunch of hobbled foreign competitors of German companies if they chose to engage in aggressive enforcement of GDPR against foreign companies?

See also the answer to when you asked 17 days ago: https://news.ycombinator.com/item?id=17005603

Please link to the specific law that exists outside the GDPR that requires such warnings. It has to be written somewhere...you (and other fans of GDPR) keep making this argument, so such a law must exist. The "answer" you linked to was just more of the same stuff you keep spouting, not a written law. If I can see such a law in the "old and large legal framework" you GDPR fans keep referring to that is somehow supposed to protect us from abuses, I'll happily admit that I'm wrong.

You're no doubt going to tell me that's far too vague and woolly. So this link might give you a flavour of how EU fundamental principles[1] came about from a bunch of centuries old separate national legal systems:

http://blogs.northampton.ac.uk/law/2015/11/02/proportionalit...

Just a random result on first page - there may be better or more easily readable sources.

That proportionality applies to everything in EU law, and there have been numerous cases through the courts, national Judicial Review, and taking cases to the EU Courts of Justice. The principle is firmly enshrined.

As with anything human mistakes are made, so of course there are appeals from time to time. That's how case law gets made.

[0] http://fra.europa.eu/en/charterpedia/article/49-principles-l... [1] https://en.wikipedia.org/wiki/General_principles_of_European...

Again the problem is that this is in the eye of the beholder. With 20 million euro maximum fines, it would be easy to say that 100k euros is proportional for the lowest levels of offenses - after all, its only 0.5% of the maximum. But that would still kill most small businesses.

Regardless, it’s pointless to argue since GDPR is here in about 36 hours, and we will all get to witness its wrath - hopefully from the sidelines. I think that within a year, most US based websites will have closed their doors to EU residents, which may be the worst aspect of this for both the EU and the US. It’s sad, but nobody - even sites with the best of intentions - can take on the liability of potential 20M euro fines, regardless of what you say the odds are of those actually being handed out.

> I think that within a year, most US based websites will have closed their doors to EU residents

I would be astonished if that is the case. If it shuts out those not willing to play nicer with data and privacy - great! Even if that ultimately includes Facebook.

Every small business within the EU is adopting this "potential liability" without any signs of a rush to relocate outside the EU or shutting down.

But what irritates me a lot more is the many GDPR fans here who not just disagree with this assessment but accuse the other side of ill intent.

It’s disgusting to call people evil and shady because they are uncomfortable with relying on the voluntary goodwill of some faceless overseas bureaucrat that they did not elect and who has been given the power of life and death over one’s livelihood. 99% of people here who have concerns don’t want to violate user privacy, but this law is so shitty that they don’t even know how to comply. And every single thread is packed with people exclaiming that it’s so obvious and easy, while all spouting totally different and contradictory advice. What a shitshow.

Sarbanes-Oxley in particular is much more draconian than any UK corporate law, and this is a barrier to me coming and breaking the law in the US, so you should change that too.

I didn't vote for your overseas faceless bureaucrat either, so I can I treat US law as optional?

Sorry Team America, you don't get to choose our laws

I didn’t elect these governments, I don’t know them or trust them, and I don’t know or trust you either.

I don’t trust unaccountable power as a general rule.

I think this is a huge strawman argument that you've constructed and hinged your entire line of reasoning on.

The EU claims jurisdiction over EU businesses. The reason very large US businesses are caring about GDPR, is because they are multinational businesses with a significant presence in the EU, i.e. they are also EU businesses. And if you're doing business in a country, you have to comply with local law. There's nothing new or weird or over-reaching about that.

When Facebook constructs a data center somewhere in the EU, the local Facebook subsidiary has to comply with local zoning laws, building codes, and labour laws.

When Facebook gathers personal data about EU citizens, the local Facebook subsidiaries have to comply with local privacy laws.

Note that Facebook isn't extending the GDPR protections to non-EU users, because it doesn't have to! It only has to extend GDPR protections to EU users, if they wish to keep their European subsidiaries.