Airbag controllers have a circular buffer of the last 15 seconds or so of the vehicle basics - speed, steering angle, acceleration, braking. No GPS. That data can usually be retrieved from the wreckage after a crash. This requires physical access to the vehicle. The data is used to analyze airbag failures, especially unwanted airbag deployments, and for crash reconstruction.
Airbag controller data is much less extensive than what Tesla seems to sending back to the mothership.
* and there are European citizen dual passport shenanigans
If the company is established in the Union, then GDPR applies to all personal data processing it does. See Article 3(1): "This Regulation applies to the processing of personal data in the context of the activities of an establishment of a controller or a processor in the Union, regardless of whether the processing takes place in the Union or not."
The question, then, is Tesla merely a company that is offering goods and services to people in the Union, but not itself established in the Union, or is Tesla established in the Union?
Point: how is the GDPR ever going to be enforced between US citizens and US companies-with-an-EU-presence?
It also gives the right to to sue. See Articles 79, 80, and 82.
There's a nice summary here: https://privacylawblog.fieldfisher.com/2016/getting-to-know-...
Here's an interesting law review article examining these developments: The Arc and Architecture of Private Enforcement Regimes in the United States and Europe: A View Across the Atlantic, https://law.unh.edu/sites/default/files/media/rathod_-_final...
Personally in terms of public policy I prefer private action, but maybe that's because I'm American. Private actions are usually predicated on actual, individualized harm, whereas regulators can strong-arm companies without any evidence of actual harm. Theoretically it makes for a better business environment, especially for startups, legal anxiety about nuisance lawsuits notwithstanding[1]. But private action doesn't scale; if you don't permit aggregation of claims (i.e. class actions) then private enforcement can't redress systemic behaviors.[2]
[1] The anxiety is invariably overblown. I think it's because most people's eyes will glaze over when hearing stories about regulator enforcement actions. But stories about slip & fall lawsuits are both legion and relatable; like with terrorism, people develop a false sense of the legal risks and costs.
[2] I mean, it could work without aggregation if you changed the rules of litigation to really streamline individual claims, such as by shifting the burden of proof onto the defendant for certain categories of behavior. Then it would sort of act like a dynamic tax that responded to business practices. Keep your customers happy and you pay a minimum, baseline tax--the cost-of-doing-business that is whatever amount you want to pay out for fraudulent claims, not unlike what businesses already do with accounts payable and shrinkage. Do something that might upset your customers and you'll have to face an onslaught of cases that either require a quick payout or costly litigation. I imagine such a regime would look much like that with class actions, with specialized law firms that identify and aggregate plaintiffs to benefit from economies of scale, and take a cut of the proceeds. But it would still make it much easier for people to prosecute small claims themselves.
No, they'd sue to get it from the EU one. As it's part of the same company. The rest of your questions are predicated on the core misunderstanding you have of this so don't apply.
> how is the GDPR ever going to be enforced between US citizens and US companies-with-an-EU-presence?
4 percent of the organization's annual global revenue will work quite well I'd imagine.
EDIT: A nasty surprise that might be, too, if it turns out there was important data via that service that you wanted to access abroad but couldn't.
It could comply the normal way.
(i) might be enforible against a US corp if they have something in the EU to do business
More likely it’s “we want to be the only one who can see it.”
Semi-related: Reminds me of the time Amazon promoted a “recommend books to your friends” feature, and someone used it to make a recommendation to me with a vaguely threatening message attached. I asked them who it was and they screamed bloody murder about protecting customer privacy and I’m like “really? Privacy of your identity to a friend you’re recommending a book to? As a feature that you’re allowing to be repurposed into an anonymous messaging service?” (Eventually they relented.)
> When asked why Tesla has an apparent policy requiring drivers who want their own data to file for a subpoena, a spokesperson framed it as a privacy issue.
> “We handle all customer data in accordance with our Owner’s Manual and privacy policy, which clearly outlines the type of data we collect and the lengths that we go to protect a customers’ privacy in the process,” Tesla said via email, referencing back to a statement on the Tesla website about the company’s data collection practices.
You can pay a third party $1000 to access the data, or Telsa will publicly shame your driving if they think you are in the wrong during a crash, but they really need to fight you to protect your privacy from yourself?