What consequences are there to ignoring GDPR rules as a non-EU entity?

Question

If a non-EU entity ignores the GDPR rules, including not paying any fines they receive from not following them, what consequences are they subject to? Can a company simply decide to ignore GDPR rules while still providing their services to EU citizens?

for clarity: assume the company does not have anything in the EU: No local offices, no support staff, no remote workers, no contact details, nothing that would allow someone to make the case that they fall under EU jurisdictions. However, the products they provide follow relevant non-GDPR regulations that deal with health and safety. They just don't want to deal with GDPR rules because they think those rules are nonsense in their case.

Answer 1

Enforcement against non-EU entities is difficult, and especially digital services would be impossible to shut down. Ultimately, enforcement would depend on judicial assistance between the relevant EU member state and the jurisdictions where the data controller is established or has relevant assets.

Your case involves physical goods and other regulations though, so that (some amount of) compliance by the data controller is necessary in order to have continued access to the EU single market. Which instruments for enforcement of fines are available depends on the EU member state, but could e.g. involve confiscation of products or payments.

A non-EU B2B service provider would also have economic incentives to comply as EU data controllers cannot share personal data unless an adequate level of protection is ensured.

In reality, it is fairly unlikely that non-EU data controllers will get fined anytime soon because data protection authorities tend to prioritize more clear cut cases, and tend to stay within their jurisdiction. Of course, non-EU data controllers are usually required to register an EU representative precisely to subject them to a particular authorities' jurisdiction, but a non-compliant controller is unlikely to do that.

A note on the GDPR's territorial scope: it is far less extraterritorial than some people believe. Per GDPR Art 3(2) the regulation applies to non-EU data controllers, (a) to the extent of their processing activities that relate to offering of goods and services (also unpaid services) to data subjects in the EU, or (b) when they monitor/track behaviour of data subjects as far as the behaviour takes place in the EU. For example, a B2C company would have to comply with the GDPR regarding how they handle shipping addresses of their EU customers. The EDPB has issued in-depth analysis as part of their guidelines 3/2018 on the territorial scope. However, the ECJ has found that some of the GDPR's effects are confined to the EU. For example, Google has to hide some results from EU searches in order to comply with the GDPR's Right to Erasure, but cannot currently be forced to hide the results from non-EU searches.

Answer 2

If the company has got the balls it can try, and, if small and lucky enough, even get away with it.

But otherwise expect a court in the EU to issue a fine and try to enforce it where the company domiciles (which might work depending on agreements between the host country and the EU).

Also, the owners/directors may end up being subject to personal sanctions so that their future travels to the EU may prove troublesome.