11

The GDPR has been in effect for 2 years now and theoretically applies to any company on the planet which deals with personal data belonging to EU residents. But practically speaking, enforcing this law should be quite difficult, as EU authorities have zero direct enforcement power over foreign corporations without EU assets.

Here's a scenario that would satisfy the requirements of this question:

  1. A website was operating outside the EU, with no EU legal entity established and no payments accepted from EU users
  2. An EU court ruled that they must still comply with GDPR because they happen to have visitors living in the EU
  3. Said website ignored the EU court ruling entirely, refusing to comply
  4. The EU managed to convince the authorities of the country where the website is located to enforce the judgement on their behalf

I'm interested in any country outside of the EU, EEA or the UK where this happened.

Improve this question
8
  • 2
    Thats a specific definition of "enforce", whereas the EU can enforce the GDPR in other ways including restricting the offending foreign company from accessing EU banking or commercial services (neither of which necessarily require assets in the EU) - requiring a foreign judge to apply foreign law is not the only option. Did you want answers that are that narrow in scope?
    – user28517
    Commented Nov 2, 2020 at 19:57
  • 1
    @Moo yes, that would be a good example too. But the answer should also clarify if the enforcement was successful - i.e. whether or not the foreign company agreed to follow EU rules or not.
    – JonathanReez
    Commented Nov 2, 2020 at 20:02
  • 1
    I'm also curious: have any been obtained, regardless of enforcement?
    – Ryan M
    Commented Nov 3, 2020 at 11:57
  • This might be an example en.wikipedia.org/wiki/Cathay_Pacific
    – rightlifesavecompenthusiast
    Commented Nov 12, 2020 at 5:56
  • 1
    Please note that the EU is not competent to enforce the GDPR (except when it concerns data processing by EU institutions). The EU Member State Data Protection Authorities ("DPAs") are the competent authorities in this regard. Enforcement by DPAs is also subject to the national laws of the respective Member State.
    – ln e
    Commented Nov 22, 2020 at 12:07

1 Answer 1

Reset to default
5

EU Member State Data Protection Authorities ("DPAs") have fined foreign legal entities (pursuant to Articles 58(2)(i) and 83 GDPR and further national provisions), however it is not publicly documented whether the specific situation you described has occured. Even if such situation would arise, I would think that it is unlikely that DPAs imposing administrative fines could enforce their (fine imposing) decisions outside the EU, even if the decision in question was confirmed by a court. For instance, in the Netherlands there is not a strong legal basis for the (mutual) recognition and enforcement of foreign administrative decisions. I could imagine that the same applies to other EU Member States.

However, please note (possible) civil liability

Your question seems to refer to enforcement of the GDPR under instruments of administrative / public law. Please note however that the GDPR can also be enforced by private individuals and organizations, e.g. through tortious liability claims. See for example Amsterdam District Court 2 september 2019, ECLI:NL:RBAMS:2019:6490 for a situation (albeit purely national), in which the Court awarded damages for a GDPR breach to a data subject. Possibly, a similar case could be brought against an entity outside the EU that processes data of EU data subjects, contingent upon the outcome of certain questions of International Private Law. With regard to civil damages, there is an extensive international legal framework that covers the cross-border enforcement of rewards for civil damages. Likely, such rewards for damages could more easily be enforced outside the EU. However, I must note that such (private) cross-border enforcement of the GDPR has not happened in practice (yet) either (as far as I know).

(Please note that this answer assumes (per the question) that the GDPR is applicable and only deals with the question of the territorial aspects of subsequent enforcement. See about the territorial scope of the GDPR: What is the legal mechanism by which the GDPR might apply to a business with no presence in the EU?).

Improve this answer
2
  • About jurisdiction for claims for damages under the GDPR, see Article 79(2) and Recital (147) GPDR, as well as Article 67 Brussels I Recast Regulation (Regulation (EU) 1215/2012). Furthermore see Ramona AG v Reliantco Investments Ltd [2019] EWHC 879 (Comm) (bailii.org/ew/cases/EWHC/Comm/2019/879.html).
    – ln e
    Commented Nov 22, 2020 at 13:16
  • 1
    Thanks, that's a good answer. Would be extremely curious to see a GDPR case a foreign court, hopefully someone will post an update in the upcoming years.
    – JonathanReez
    Commented Nov 23, 2020 at 0:35

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .