This question is inspired by this other question asks about how a (fictional) Small Town News USA Inc could prepare for GDPR.
Although opportunistic lawsuits against US-based businesses on their handling of EU-residents data might be possible, I find it doubtful that EU would audit businesses outside their jurisdiction for GDPR compliance.
This is why I wanted to ask:
- Is it actually necessary for businesses (such as a Small Town News USA Inc) that do not reside in EU to care about GDPR?
- If it is then how (and by whom) would compliance be audited and/or enforced?