3

The GDPR is a law the EU passed requiring businesses, even foreign businesses, to protect the privacy of EU citizens.

Now of course, the EU's jurisdiction is not global, but the EU does have treaties with other countries they may permit it to enforce the GDPR in those countries or requires those countries to enforce it on the EU's behalf. For example, this answer implies the U.S. is one of those countries.

In which jurisdictions outside the EU can the GDPR be enforced?

Note that I am assuming that the whoever is violating the GDPR does not live nor has any assets in the EU that the EU could seize.

3

The GDPR applies to anyone anywhere who is collecting data on people in the EU, including visitors.

As far as enforcement goes, it would depend on the circumstances. Ultimately the directors of whatever company was involved could be extradited, or if they ever visited the EU they could be arrested.

  • "Ultimately the directors of whatever company was involved could be extradited" do you know which jurisdictions would respect a request to extradite someone based on a GDPR violation? In particular, which jurisdictions recognize the GDPR as applying to within them. – PyRulez Jan 29 at 0:34
  • Citizenship has nothing to do with the GDPR. It applies to data subjects who are in the EU, regardless of their citizenship, and does not apply to data subjects outside the EU when the data controller and processor are outside the EU, even if the data subject is an EU citizen. Your link shows this by virtue of its reference to "data subjects who are in the Union." – phoog Jan 29 at 2:26
  • @phoog Good point. Answer edited. – Paul Johnson Jan 29 at 9:48
  • 1
    @PyRulez, as described in the linked answer, several nations, including the US, have treaties by which they should enforce the judgments of courts o nations within the EU. If a judgment is first obtained in an EU country, there can then be an application to enforce it in the country where the person or entity subject to the judgment is located. Until there are more actual cases available, we can't say if the GDPR will be treated differently from other laws under this process. – David Siegel Jan 29 at 13:37
  • 1
    In the US, my understanding is that we won't extradite anybody for a crime which we recognize as a constitutional right (free speech, which parts of the GDPR infringes on). I'm not sure a court would enforce fees, either. – kbelder Jan 29 at 18:01

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.