You’re going to get downvoted for that comment, but you do raise a legitimate question of enforceability. Sure the EU can say any company in the world who has EU residents’ data should comply with GDPR. But... or what exactly? The EU doesn’t have the power to fine companies outside of their jurisdiction. I mean, they can try. But as far as I know there is no enforceability to ensure that the company actually pays the fine.

For larger companies with offices in the EU (especially the ones headquartered there for tax purposes), they obviously have no choice to comply. But what about a small startup, with its only domicile and employees in the US?

What exactly could the EU do to punish a startup in that case? Unless they have some enforceability treaty with the US, I don’t see how they have any legal ground to extract fines for arbitrary laws defined in their jurisdiction. The worst they could do is ask EU ISPs and/or payment networks to block the offending sites, right?

Corporate counsel, who actually went to many of the lead-up conferences for GDPR, said the data authorities from many member countries didn’t even hesitate before saying they would file civil lawsuits against non-EU companies.

Such a suit could be ignored too, but it would certainly be a PITA for vacationing executives who get locked up in Italy for an outstanding summary judgement.

> but it would certainly be a PITA for vacationing executives who get locked up in Italy for an outstanding summary judgement.

It's a good thing there are a lot of beautiful parts of the world other than Italy.

I won't DV anyone. I use an addon that hides the down arrows. [0]

I suppose when I asked the question, I am assuming internet businesses for the most part don't isolate themselves to a specific region, so their reply probably makes more sense for the businesses that operate in a small locality. Perhaps they have such a business. I should have considered that prior to asking.

Where this might start to get interesting is if people use infrastructure that is in multiple regions and that infrastructure provider has an agreement to block companies that do not comply. So if AWS for example had such an agreement, then non compliant companies could find their sites broken, even if they are only hosted in the U.S., not that this would ever happen, but it could.

[0] - https://userstyles.org/styles/9038/hide-down-vote-arrows-and...

If they have significant business in the EU then they can be fined regardless of size but the rules indicate that working towards compliance can go a long way to reducing the size or even existence of fines. Plus to get to that stage you have to ignore someone's request to remove their personal data.

It applies to companies that do business in the EU. They could at least seize any assets that you have in the EU, including future profits there. If you don't do any business in the EU to disrupt then this doesn't apply to you anyway.

It actually isn't clear that it doesn't, as best I can tell. I don't have the text in question in front of me, but one of the questions I've asked and haven't gotten a solid answer on is - who is covered by GDPR? Is it only EU citizens residing in the EU, or EU citizens generally?

If it's the latter, then someone with both US and German citizenship could be covered even if they've never been to the EU.

This is a very dangerous interpretation. Let me tell you why: this opens the door for someone, let's say China, to say that their laws apply to Chinese nationals outside of China. You know, censorship and the rest.

While GDPR is a good idea, its legal impact can only be for business conducted within EU boundaries, or we are going to open up a Pandora's Box like this.

You mean: like giving fines to ANY company doing business with Iran just because some US President decided to cancel its own part of an international treaty...? ;-)

Come on: you're whining but you're doing that kind of extra-territorial stuff for decades!!!

GDPR is written in terms of rights people in the EU have against companies operating in the EU.

Which is to say your hypothetical dual citizen would have zero rights under GDPR in their dealings with purely US entities.

"data subjects in one or more Member States in the Union."

People (regardless of EU citizenship status) who are physically in the EU.

This isn't so hard.

Anyone who is in the EU (citizens and not) at the time of using the service. EU citizens living abroad are not covered (unless they are visiting Europe, of course).

Geoblocking is not enough. A user in Europe that bypasses an EU block with a VPN is still covered (this has been explicitly stated).

https://gdpr-info.eu/art-3-gdpr/ Art 3 (2b)

> The law, like any other EU law, obviously does not apply outside the EU.

There are precedents for the opposite. If you have a grandparent born in some EU countries, you have EU citizenship according to the law of that EU country, even if you never set foot on that country and have no contact at all with the EU. There is a (non-EU) country which says that if you're a citizen of that country, you have to pay income taxes to it, even if you never set foot on that country and have no contact at all with it. At least one country says that its law applies to buyers of widgets manufactured in that country, even if they are sold by someone who never set foot on that country and has no contact at all with it, to someone who likewise has no contact with it. And so on.

GDPR applies to all EU citizens. It doesn't matter if the citizen is accessing the web site from the eu or another country. Blocking people in the EU doesn't block all eu citizens from accessing your product/service.

That's just not how it works.

Recital 23 (referring to Article 3, Territorial Scope)

> In order to determine whether such a controller or processor is offering goods or services to data subjects who are in the Union, it should be ascertained whether it is apparent that the controller or processor envisages offering services to data subjects in one or more Member States in the Union.

An attempt to prevent EU users from accessing the site at all is about as strong a signal as it gets regarding this. When you're blocking all of Europe by IP, it's pretty fucking obvious you're not envisaging offering services there.

People keep saying this but its not true. The EU has no jurisdiction outside of the EU. If both the user and site are outside of the EU at the time of the transaction, they can not make claims, regardless of citizenship.

The EU has jurisdiction over EU citizens, even those outside of the EU (see US citizens and taxes). But I question how the EU would have jurisdiction on anyone who is outside of the EU and does all their business outside of the EU, even with EU citizens. The EU can prohibit EU citizens from visiting websites that violate the law if they want. They can also block EU residents from visiting those sites.

Maybe they can get the firewall technology to do all of that from China too.

No, it is true, If you don't the EU Army will come and get you. /s

It's a basic idea, and HN prides itself on being smart, but there aren't global laws. No one gets to enforce civil penalties outside of their jurisdictions, without exceptional circumstances. If they fine you and you don't have offices there just ... don't pay? The EU might not exist in 10 years anyway.

Do you have a source? It is my understanding that the world operates on the idea that the laws of where you are located only apply to you.

An expat living in the EU is protected because they reside in the EU. If you are living in the USA, you must follow American laws.