8

This question is inspired by this other question asks about how a (fictional) Small Town News USA Inc could prepare for GDPR.

Although opportunistic lawsuits against US-based businesses on their handling of EU-residents data might be possible, I find it doubtful that EU would audit businesses outside their jurisdiction for GDPR compliance.

This is why I wanted to ask:

  1. Is it actually necessary for businesses (such as a Small Town News USA Inc) that do not reside in EU to care about GDPR?
  2. If it is then how (and by whom) would compliance be audited and/or enforced?
Improve this question
1

2 Answers 2

Reset to default
9

Is it actually necessary for businesses (such as a Small Town News USA Inc) that do not reside in EU to care about GDPR?

Only if they offer goods/services to or monitor behavior of people in the EU (Art. 3(2)).

Note that:

having a commerce-oriented website that is accessible to EU residents does not by itself constitute offering goods or services in the EU. Rather, a business must show intent to draw EU customers, for example, by using a local language or currency.

If it is then how (and by whom) would compliance be audited and/or enforced?

Supervisory Authorities will care of it.

Improve this answer
20
  • 1
    So it would be enough to have site in English? (A local language in still-in-EU-GB)
    – user13842
    May 25, 2018 at 11:25
  • 1
    @9ilsdx9rvj0lo English is way too global language to hint applicable territory. Using currency (e.g. dollars vs pounds) would be way more effective. Or just explicitly say in which countries the business is done.
    – Greendrake
    May 25, 2018 at 11:35
  • 1
    @Greendrake Meaning what? Say Small Town News has their website and allows EU subscriptions. They're based in Small Town, they operate via the web. They don't block EU subscriptions. What can the EU do?
    – Mars
    Jan 8, 2020 at 6:13
  • 1
    Google exists as a legal entity in the EU. Small Town News doesn't, and it has no EU assets. From what I linked, it seems they cannot actually fine someone outside of their jurisdiction
    – Mars
    Jan 8, 2020 at 6:20
  • 1
    Are you implying that owners/directors of companies in violation of GDPR are subject to travel restrictions by the EU? That seems like an answer! But it needs a source
    – Mars
    Jan 8, 2020 at 6:27
0

Greendrake has some great points about what businesses are considered to be operating in the EU. It should of course be noted that the US is not part of the EU and is thus not part of the EU's jurisdiction.

Which brings us to the question of how is the GDPR enforced in this case:

This answer in Politics suggests that there isn't really a way to enforce outside of the EU

Basically, their method of non-EU enforcement seems to be "we'll figure it out". Depending on what 'appropriate steps to develop international cooperation mechanisms' means, it appears like treaties or others agreements will be the mechanism for enforcing the GDPR outside the member states.

This article (updated Jan 2019) also suggests that there is little actual enforcement:

The UK ICO issued a warning to the Washington Post over how it was obtaining consent for cookies. The ICO concluded that consent was not freely given under GDPR Article 7 because the paper did not offer a free alternative to accepting cookies. However, the ICO noted that there was little that it could do if the Washington Post decided not to change its practices. This comment by the ICO leaves its ability and likelihood to bring enforcement actions in doubt.

Greendrake suggests in the comments of his answer that the EU may cause issues for the owners/directors of Small Town News inc if they ever pass visit or pass through the EU, but that needs a source still.

Improve this answer
11
  • 2
    Well, if the company is receiving payments from customers in the EU, the EU can stop this payments.
    – Josef
    Jan 8, 2020 at 9:40
  • @JosefsaysReinstateMonica Citation needed?
    – Mars
    Jan 8, 2020 at 14:13
  • 1
    In short the EU can do the same to a US company that the US does to European companies when they do not comply with US laws. Sample FATCA. If European banks don't collect and send (at their cost) all bank data of their US customers living in Europe to the IRS - then any funds sent to that bank from the US can be blocked and transfered to the IRS. investopedia.com/articles/personal-finance/102915/…
    – Mark Johnson
    Jan 8, 2020 at 19:55
  • @MarkJohnson That sounds like a fairly specific agreement and is also at a bank-level, rather than consumer-level. Is there any evidence, even anecdotal, that GDPR can do anything similar?
    – Mars
    Jan 9, 2020 at 0:24
  • 1
    Yes, the only was would be through court rulings in each individual case. That could, if the Court deemed it severe enough, effect entry in to the Schengen Area or other financial measures. The infrastructure needed to prevent subscription of a newspaper, that does not apply the GDPR, would be just as uneffective as FATCA. That bad sample should (possibly its only positive aspect) serve as a lesson that should not be repeated.
    – Mark Johnson
    Jan 9, 2020 at 2:44

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .