Imagine company Z (spooky, I know). Company Z processes what counts in the EU GDPR as personal information, but company Z will refuse to comply with any requests from the EU, which would make it GDPR compliant. As a result, the company is now non-compliant, and normally fines would be levied. However, company Z is an automaton, ignoring all fines from any entity which is not part of the United Sates federal, or state government, and will only comply with judgements rendered by US courts from within the United States. Company Z does not settle out of court.

Company Z has no recourse from the EU, and does not rely on any EU businesses to operate.

What law could be used by the EU parties to enforce fines and or penalties onto company Z in United States court?

For the purposes of this question, company Z can be in any state within the US, with a preference towards citing federal law, but all state laws are welcome too, so long as they come from a single state.

  • 1
    How are they getting the data in the first place and who are they selling it to? The answer to that question could determine who the EU can go after.
    – Joe W
    Commented Apr 21 at 0:42
  • @JoeW The company lets anyone visit their site, and make an account with some private info. The company does not prevent EU citizens from making accounts, but does not do business with them, or their info
    – tuskiomi
    Commented Apr 21 at 1:01
  • 1
    I think you are misunderstanding something, just because someone visits your site from the EU doesn't mean you need to follow GDPR and it only applies if you do some sort of business in the EU.
    – Joe W
    Commented Apr 21 at 1:12
  • 2
    If I google "automaton business" I don't get anything like what you are suggesting it means.
    – Joe W
    Commented Apr 21 at 1:17
  • 1
    "None"? I have no idea how to prove a negative though. How would there even be a GDPR fine, given that they don't do business in Europe or with Europeans as specific target demographic? I mean fines are not issues by robots either.
    – nvoigt
    Commented Apr 21 at 6:50

2 Answers 2


The United States isn't a signatory to any treaty regarding recognition of foreign judgments, leaving those questions to the states, as per USC decision Hilton v. Guyot.

Some states have enacted the Uniform Foreign-Country Money-Judgments Recognition Act of 1962 that states :

Section 3

Except as provided in section 4, a foreign judgment meeting the requirements of section 2 is conclusive between the parties, to the extent that it grants or denies recovery of a sum of money. The foreign judgment is enforceable in the same manner as the judgment of a sister state which is entitled to full faith and credit.

Note that, under that act, a fine by the Data Protection Agency of the country would probably be unenforceable, but would most likely become enforcable after appeal to a court.

SECTION 4. [Grounds for Non-Recognition.]
(a) A foreign judgment is not conclusive if
(1) the judgment was rendered under a system which does not provide impartial tribunals or procedures compatible with the requirements of due process of law;

It may also be unenforcable if the court finds that Personal Jurisdiction is not fulfilled (see Section 5)

Most states have enacted, updating from the 1962 act, the Uniform Foreign-Country Money Judgments Recognition Act of 2005 which quash the above, removing fines from the act

(b) This [act] does not apply to a foreign-country judgment, even if the judgment grants or denies recovery of a sum of money, to the extent that the judgment is:
(1) a judgment for taxes;
(2) a fine or other penalty;


GDPR only applies to organisations based in and/or doing business in the E.U. - a non-EU company cannot be prosecuted/fined under GDPR.

The law of the countries that Company Z is incorporated in and does business in applies. For example the United Kingdom is now outside of the EU, but has it's own Data Protection Act, which encompasses many of the same principles. If Company Z is a UK-based company then they must comply with the law of that country, so the Data Protection Act. If they do business in Spain then they must also comply with Spanish law, so GDPR too - since Spain is in the E.U.

For a US-based company, US federal/state laws apply. A cursory search reveals that several laws might cover it. This is in addition to the laws of the countries that the company does business in.

/not a lawyer

  • 1
    That isn’t fully accurate even if a company is based elsewhere if they do business with people in the EU it means GDPR would apply to them. Otherwise companies would just move to countries with lax laws to avoid strict ones in other countries.
    – Joe W
    Commented Apr 21 at 17:39
  • @JoeW The OP mentioned in a comment that Company Z does not do business with customers in the EU Commented Apr 21 at 17:41
  • That doesn’t change the fact that GDPR isn’t just applied based upon the country that the business is located. Also just because a company doesn’t rely upon business in the EU doesn’t mean it isn’t doing business in the EU. It just means that if they are it isn’t critical to them.
    – Joe W
    Commented Apr 21 at 17:47
  • 2
    The first paragraph is just false. GDPR also applies if some of your customers are in the EU, regardless of where in the world the company is based.
    – quarague
    Commented Apr 22 at 8:30
  • 2
    The second half still says 'a non-EU company cannot be prosecuted' which is wrong. Your entire idea, that the law of the country of incorporation is the only relevant one is off. If a company does business in some country than that countries laws apply to that business, regardless of the country of incorporation.
    – quarague
    Commented Apr 22 at 9:40

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .