It is a bit more complicated: the EU considers the protection of personal data a basic human right (charta of fundamental rights article 8). As such there are cases where the EU considers itself to be the responsible authority, even if the company is not within the EU, as long as the data subject is.

There are limits to that due to contract law, but there are also limits how many rights one can sign away, especially when dealing with predatory corporations.

To give a less digital analogue: if you are robbed, your local police is the authority you talk to. They are not going to tell you that you need to find out who robbed you and talk to the police in their home town.

That’s a great point. Sorry I was not as inclusive as I should have been in my explanation.

I am a dual US|EU citizen, but I am culturally American. I was trying to explain it from the perspective of Americans.

Thank you again for the clarification.

Have the EU been able to impose GDPR penalties on an org with no staff or assets and no representation in the EU?