> If the Data Subject, moves out of the EU border and say becomes an expat, or goes on holiday then their personal data processed under these circumstances is not covered by the GDPR and they are no longer a Data Subject in the context of the GDPR, unless their data is still processed by an organisation "established" in the EU.
Good luck enforcing EU laws in the United States - I'm sure our government would be thrilled to extradite US Citizens (who have never been to the EU) for GDPR violations.
Where the hell did this ridiculous talking point come from? Do you actually know what "law" even is? Of course someone in another jurisdiction can blow off law from another polity if they feel like including when dealing with that polity's citizens, and in turn said polity can try to pursue action against them. But if they do not travel their and have no asset exposure there and their own country has a reasonable level of power and protectiveness of its citizens then the likely responses tend to be limited and passive in nature, such as internet censorship orders.
I mean, this should be utterly obvious given that most Westerners are not complying either laws around the world constantly. We can and do criticize the leadership and governments of any and every country as is our right in ways that are absolutely illegal according to those countries, just for one simple example. The EU is free to get some help from China and make a Great Firewall of their own and censor the net, but if an American blows off something of theirs that is legal in the US and they come demanding the US enforce their law they will get told to pound sand. I mean, this isn't even just normal discretion, in some cases Congress has even flat out made it illegal for the US to honor foreign judgements, such as the 2010 SPEECH Act which rendered all foreign libel judgements unenforceable, unless it's a country that has a direct equivalent to the First Amendment of equal enforcement (I'm aware of zero countries in the world where this is the case) or the defendant would be liable if tried in the US, which in practice means basically any enforcement faces a near insurmountable bar.
That doesn't address things at all, as the top comment and subsequent ones immediately point out. The entire foundational point of a polity is precisely that it defines the law within its own jurisdiction. No country, not even the USA, is powerful enough to actually act as a world government right now, which means that it is completely legally fine and in some cases morally correct to blow off laws of other polities so long as one remains careful to remain out of their power. The EU can demand others do anything they like in the same way any random person on the street could but whether that actually means anything is purely a matter of power.
With respect (and to downvoters as well) I did not take dominotw’s reply as uncivil, and they has my upvote even if I disagree and wish they’d expanded with their own thoughts rather then merely linked a previous thread. It was not an adhom or personal attack of any kind, and expressing serious irritation over a very serious issue should not itself requiring flagging if it’s a real response.
I think the fear is that troll law firms will sprout up that get really good and nailing smaller companies for a minor, relatively harmless infraction.
What would they gain? The company would get a warning from an officer telling them they're not compliant and to address it. If the company fixes the issue, all good. If it doesn't, it gets fined. The troll law firm won't see any money from that fine.
That's not how GDPR is enforced. A relatively minor, harmless infraction will get at most a letter from the regulator asking for it to be fixed. More likely is that fuck all will happen, which is what currently happens in the UK.
Huh, I thought it was grounds for a hefty fine right off the bat. What about horns being trumpeted that GDPR is going to stifle innovation (smaller companies unable to muster the legal force to comply)?
They want you to comply, first and foremost. If you comply, then no fines. If you don't comply, you'll get fined, that's how I understand.
GDPR is a process, it's about pushing companies to good practices through compliance. A lot of it makes sense, for example, making sure your staff understand basic IT security practices, which is no different to health and safety.
It seems likely that large internet businesses will probably pay to comply with GDPR.
Many small businesses, whose customers are often mostly regional anyhow, may decide that it's just not worth the cost of compliance.