And who has jurisdiction to enforce that? Can a US citizen (who has never been in the EU) sue in an EU court to compel release of the US citizen's data from the US division/unit/hq/whatever? Does that court have authority to compel the release by the US division? Can the EU court compel a US court to find similarly?

Point: how is the GDPR ever going to be enforced between US citizens and US companies-with-an-EU-presence?

Agreed, it’s not likely to be enforced. Note that you cannot sue anyone over the GDPR, however. That is a fundamental misunderstanding that I keep seeing repeated - the GDPR only gives people the right to report companies to the relevant authority. The authority can then investigate and issue a warning/fine as they see fit.

> Note that you cannot sue anyone over the GDPR, however. That is a fundamental misunderstanding that I keep seeing repeated - the GDPR only gives people the right to report companies to the relevant authority

It also gives the right to to sue. See Articles 79, 80, and 82.

There's a nice summary here: https://privacylawblog.fieldfisher.com/2016/getting-to-know-...

That's interesting. Traditionally European law eschewed private rights of action in favor of public regulators, while the U.S. heavily favored private enforcement. But now Europe is increasingly providing for private action. Whereas the U.S. is increasingly disfavoring private action (e.g. limitations on class actions), and attempts to extend public enforcement are failing (e.g. Consumer Financial Protection Bureau).

Here's an interesting law review article examining these developments: The Arc and Architecture of Private Enforcement Regimes in the United States and Europe: A View Across the Atlantic, https://law.unh.edu/sites/default/files/media/rathod_-_final...

Personally in terms of public policy I prefer private action, but maybe that's because I'm American. Private actions are usually predicated on actual, individualized harm, whereas regulators can strong-arm companies without any evidence of actual harm. Theoretically it makes for a better business environment, especially for startups, legal anxiety about nuisance lawsuits notwithstanding[1]. But private action doesn't scale; if you don't permit aggregation of claims (i.e. class actions) then private enforcement can't redress systemic behaviors.[2]

[1] The anxiety is invariably overblown. I think it's because most people's eyes will glaze over when hearing stories about regulator enforcement actions. But stories about slip & fall lawsuits are both legion and relatable; like with terrorism, people develop a false sense of the legal risks and costs.

[2] I mean, it could work without aggregation if you changed the rules of litigation to really streamline individual claims, such as by shifting the burden of proof onto the defendant for certain categories of behavior. Then it would sort of act like a dynamic tax that responded to business practices. Keep your customers happy and you pay a minimum, baseline tax--the cost-of-doing-business that is whatever amount you want to pay out for fraudulent claims, not unlike what businesses already do with accounts payable and shrinkage. Do something that might upset your customers and you'll have to face an onslaught of cases that either require a quick payout or costly litigation. I imagine such a regime would look much like that with class actions, with specialized law firms that identify and aggregate plaintiffs to benefit from economies of scale, and take a cut of the proceeds. But it would still make it much easier for people to prosecute small claims themselves.

> Can a US citizen (who has never been in the EU) sue in an EU court to compel release of the US citizen's data from the US division/unit/hq/whatever?

No, they'd sue to get it from the EU one. As it's part of the same company. The rest of your questions are predicated on the core misunderstanding you have of this so don't apply.

> how is the GDPR ever going to be enforced between US citizens and US companies-with-an-EU-presence?

4 percent of the organization's annual global revenue will work quite well I'd imagine.

In addition to the other reply, “it’s part of the same company” is incorrect. These organizations are related but aren’t “the same company.” They’re intentionally organized this way. Ireland can go after Apple Ireland, but they’ve got no jurisdiction to go after Apple, Inc in California.

You actually seem to be misunderstanding since GDPR is not about having people sue. They can only report companies and regulators take it from there, if they want to. Also 4% of revenue has nothing to do with enforcement and reach of the EU agencies against US companies.

There's a right to sue, which includes suing for compensation, in Articles 79 and 82.

You don't need to sue in court, you can make a complaint to a covering Data Protection Agency. i.e. where the corporation's office is. They are supposed to take care of it, and they will have the power to force the local company to do things (or fine them).