7

The GDPR has been in effect for 2 years now and theoretically applies to any company on the planet which deals with personal data belonging to EU residents. But practically speaking, enforcing this law should be quite difficult, as EU authorities have zero direct enforcement power over foreign corporations without EU assets.

Over the past two years, have EU authorities succeeded in enforcing GDPR-related judgements over a single foreign business? By "enforce," I'm referring to a scenario where the foreign entity refuses to comply willingly, so EU authorities convinced a foreign court to enforce the judgement on their behalf.

  • 2
    Thats a specific definition of "enforce", whereas the EU can enforce the GDPR in other ways including restricting the offending foreign company from accessing EU banking or commercial services (neither of which necessarily require assets in the EU) - requiring a foreign judge to apply foreign law is not the only option. Did you want answers that are that narrow in scope? – Moo Nov 2 '20 at 19:57
  • @Moo yes, that would be a good example too. But the answer should also clarify if the enforcement was successful - i.e. whether or not the foreign company agreed to follow EU rules or not. – JonathanReez Nov 2 '20 at 20:02
  • 1
    I'm also curious: have any been obtained, regardless of enforcement? – Ryan M Nov 3 '20 at 11:57
  • This might be an example en.wikipedia.org/wiki/Cathay_Pacific – compenthusiast Nov 12 '20 at 5:56
  • 1
    Please note that the EU is not competent to enforce the GDPR (except when it concerns data processing by EU institutions). The EU Member State Data Protection Authorities ("DPAs") are the competent authorities in this regard. Enforcement by DPAs is also subject to the national laws of the respective Member State. – ln e Nov 22 '20 at 12:07
2

EU Member State Data Protection Authorities ("DPAs") have fined foreign legal entities (pursuant to Articles 58(2)(i) and 83 GDPR and further national provisions), however it is not publicly documented whether the specific situation you described has occured. Even if such situation would arise, I would think that it is unlikely that DPAs imposing administrative fines could enforce their (fine imposing) decisions outside the EU, even if the decision in question was confirmed by a court. For instance, in the Netherlands there is not a strong legal basis for the (mutual) recognition and enforcement of foreign administrative decisions. I could imagine that the same applies to other EU Member States.

However, please note (possible) civil liability

Your question seems to refer to enforcement of the GDPR under instruments of administrative / public law. Please note however that the GDPR can also be enforced by private individuals and organizations, e.g. through tortious liability claims. See for example Amsterdam District Court 2 september 2019, ECLI:NL:RBAMS:2019:6490 for a situation (albeit purely national), in which the Court awarded damages for a GDPR breach to a data subject. Possibly, a similar case could be brought against an entity outside the EU that processes data of EU data subjects, contingent upon the outcome of certain questions of International Private Law. With regard to civil damages, there is an extensive international legal framework that covers the cross-border enforcement of rewards for civil damages. Likely, such rewards for damages could more easily be enforced outside the EU. However, I must note that such (private) cross-border enforcement of the GDPR has not happened in practice (yet) either (as far as I know).

(Please note that this answer assumes (per the question) that the GDPR is applicable and only deals with the question of the territorial aspects of subsequent enforcement. See about the territorial scope of the GDPR: What is the legal mechanism by which the GDPR might apply to a business with no presence in the EU?).

  • About jurisdiction for claims for damages under the GDPR, see Article 79(2) and Recital (147) GPDR, as well as Article 67 Brussels I Recast Regulation (Regulation (EU) 1215/2012). Furthermore see Ramona AG v Reliantco Investments Ltd [2019] EWHC 879 (Comm) (bailii.org/ew/cases/EWHC/Comm/2019/879.html). – ln e Nov 22 '20 at 13:16
  • Thanks, that's a good answer. Would be extremely curious to see a GDPR case a foreign court, hopefully someone will post an update in the upcoming years. – JonathanReez Nov 23 '20 at 0:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.