7

This question is inspired by this other question asks about how a (fictional) Small Town News USA Inc could prepare for GDPR.

Although opportunistic lawsuits against US-based businesses on their handling of EU-residents data might be possible, I find it doubtful that EU would audit businesses outside their jurisdiction for GDPR compliance.

This is why I wanted to ask:

  1. Is it actually necessary for businesses (such as a Small Town News USA Inc) that do not reside in EU to care about GDPR?
  2. If it is then how (and by whom) would compliance be audited and/or enforced?
8

Is it actually necessary for businesses (such as a Small Town News USA Inc) that do not reside in EU to care about GDPR?

Only if they offer goods/services to or monitor behavior of people in the EU (Art. 3(2)).

Note that:

having a commerce-oriented website that is accessible to EU residents does not by itself constitute offering goods or services in the EU. Rather, a business must show intent to draw EU customers, for example, by using a local language or currency.


If it is then how (and by whom) would compliance be audited and/or enforced?

Supervisory Authorities will care of it.

| improve this answer | |
  • 1
    So it would be enough to have site in English? (A local language in still-in-EU-GB) – 9ilsdx 9rvj 0lo May 25 '18 at 11:25
  • 1
    @9ilsdx9rvj0lo English is way too global language to hint applicable territory. Using currency (e.g. dollars vs pounds) would be way more effective. Or just explicitly say in which countries the business is done. – Greendrake May 25 '18 at 11:35
  • 1
    @Greendrake Meaning what? Say Small Town News has their website and allows EU subscriptions. They're based in Small Town, they operate via the web. They don't block EU subscriptions. What can the EU do? – Mars Jan 8 at 6:13
  • 1
    Google exists as a legal entity in the EU. Small Town News doesn't, and it has no EU assets. From what I linked, it seems they cannot actually fine someone outside of their jurisdiction – Mars Jan 8 at 6:20
  • 1
    Are you implying that owners/directors of companies in violation of GDPR are subject to travel restrictions by the EU? That seems like an answer! But it needs a source – Mars Jan 8 at 6:27
0

Greendrake has some great points about what businesses are considered to be operating in the EU. It should of course be noted that the US is not part of the EU and is thus not part of the EU's jurisdiction.

Which brings us to the question of how is the GDPR enforced in this case:

This answer in Politics suggests that there isn't really a way to enforce outside of the EU

Basically, their method of non-EU enforcement seems to be "we'll figure it out". Depending on what 'appropriate steps to develop international cooperation mechanisms' means, it appears like treaties or others agreements will be the mechanism for enforcing the GDPR outside the member states.

This article (updated Jan 2019) also suggests that there is little actual enforcement:

The UK ICO issued a warning to the Washington Post over how it was obtaining consent for cookies. The ICO concluded that consent was not freely given under GDPR Article 7 because the paper did not offer a free alternative to accepting cookies. However, the ICO noted that there was little that it could do if the Washington Post decided not to change its practices. This comment by the ICO leaves its ability and likelihood to bring enforcement actions in doubt.

Greendrake suggests in the comments of his answer that the EU may cause issues for the owners/directors of Small Town News inc if they ever pass visit or pass through the EU, but that needs a source still.

| improve this answer | |
  • 1
    Well, if the company is receiving payments from customers in the EU, the EU can stop this payments. – Josef says Reinstate Monica Jan 8 at 9:40
  • @JosefsaysReinstateMonica Citation needed? – Mars Jan 8 at 14:13
  • In short the EU can do the same to a US company that the US does to European companies when they do not comply with US laws. Sample FATCA. If European banks don't collect and send (at their cost) all bank data of their US customers living in Europe to the IRS - then any funds sent to that bank from the US can be blocked and transfered to the IRS. investopedia.com/articles/personal-finance/102915/… – Mark Johnson Jan 8 at 19:55
  • @MarkJohnson That sounds like a fairly specific agreement and is also at a bank-level, rather than consumer-level. Is there any evidence, even anecdotal, that GDPR can do anything similar? – Mars Jan 9 at 0:24
  • 1
    Yes, the only was would be through court rulings in each individual case. That could, if the Court deemed it severe enough, effect entry in to the Schengen Area or other financial measures. The infrastructure needed to prevent subscription of a newspaper, that does not apply the GDPR, would be just as uneffective as FATCA. That bad sample should (possibly its only positive aspect) serve as a lesson that should not be repeated. – Mark Johnson Jan 9 at 2:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.