Does GDPR actually have any teeth outside of the EU? I mean, if somebody living in the US creates a US-centric service with no intent of offering services to the EU, surely the company doesn't have any real obligations to obey GDPR if an EU citizen decides to sign up for it? Would a US court uphold EU law in this case? I'm assuming not.

Seemingly not, if I'm reading it right.

Your comment seems to imply that it has no force, whereas the answer that you reference states quite clearer that it does - under some circumstances (targetting Europeans, offering their language or pricing in their currency)

This is way too academic. Huge data breaches in the US happen every week as of 2019, there is essentially zero criminal enforcement, and almost zero civil enforcement. These TOS induce users to transfer their sensitive data into a zero-privacy jurisdiction; it's academic whether they imply GDPR still applies. We will see if CCPA changes US behavior in 2020; it doesn't have any real penalties, but it does serve to highlight breaches, so customers might avoid the worst offenders, and patterns of CCPA violations might start getting cited in shareholder class-action lawsuits, SEC violations.

@smci Do data breaches not happen in the EU?

@user253751 They do, but under GDPR there is a potential for heavy fines (of which multiple have been given so far), and there's an obligation to notify relevant organizations if you discover that you have leaked data.

@user253751: once billion-dollar GDPR penalties become commonplace, major breaches in the EU will become very rare. It simply won't be economical(/insurable) to take the risk, rather than spend the money on security. Also, like I'm predicting you'll see this stuff work its way into corporate compliance and investor relations.

@smci Well, the other possibility is that they'll still happen every week but stuff will cost more because of the insurance. Most likely it will be somewhere in between those two extremes.

@user253751: drivers who crash their car every week/month can't get collision insurance. (EDIT: large companies will adapt so as not to regularly incur major GDPR breaches)

@smci No, but when a different driver crashes their car every week, they still happen, driving just costs more. It's not the same company that gets breached every week.

@smci where it's academic or not depends on how much presence the unidentified company has in the EU. Perhaps the EU has direct leverage over this company. We have no way of knowing. Also, a civil judgment in a European court under European law could be enforced by a US court, though the prospect is perhaps unlikely.

@user253751 even for small-scale activity like driving, an increased threat of punitive consequences (say, a speed camera being installed at an accident hotspot) does have a measurable deterrent effect. Whether the means of such deterrence justifies the ends is a matter of opinion but it would be naive to imagine there is no size of fine that could have any effect on corporate data protection.

@Will It's also silly to imagine that any size of fine will stop everyone from speeding.

@user253751 the analogy came up as a counterargument to your proposition that GDPR would have no effect on the rate of data breaches at all. Nobody has claimed that it would eradicate them completely.

@Will ... a proposition which you seem to have made up in your own mind

@MawgsaysreinstateMonica The answer linked implies that it does, but the issue of enforcement is not properly answered. It seems that at best, those supervisory authorities can audit and for enforcement, they can complain to your country to try to get your country to do something

@user253751 in the EU every country MUST have an organisation where those holding GDPR qualified data are legally required to report any breaches to. That organisation holds the legal power to investigate whether there is a cause for leveraging penalties in case a breach is reported.

@user253751 Sweden is getting pretty close by making fines income dependent (something I do NOT agree with as it introduces class justice, with penalties for the same offense being different for different people). If you're fined 100.000 Euro for speeding 10kmh you're going to think twice.

@jwenting Seems pretty sensible to me, for the reason Mars stated. Basically they are trying to make the fine equivalent to a certain amount of hours, instead of a certain amount of bread, because everyone has the same number of hours in their life. Now that I've heard about the idea, I'm amazed it hasn't been done everywhere since the beginning of time!

@user253751 so you'd also want to expand that to everything else? Like leveraging 500% sales for people with an income of $1 million and 5% for people with minimum wage, on a sliding scale obviously? Because that'd be the logical conclusion of your idea...

@jwenting Do you know how percentages work? A percentage sales tax is already proportional to the amount of money involved. If you make the percentage also proportional to the amount of money involved, then you're making the tax proportional to the square of the amount of money, which is not something anyone wants.

@jwenting Also remember the purpose of a fine is to make people stop doing something by punishing them for it. If sales tax is too high then people won't buy stuff, but the government wants people to buy stuff so they won't set it too high. With fines, that's the point. If it's not high enough to make people stop doing the thing, then it's not doing its job!

@user253751 Well, the purpose of traffic fines is to finance the police department, but you're right for most fines.

@user253751 it's not the square, because it's based on a different amount of money involved. Sales tax is a percentage of money spent, which is why it's regressive in terms of financial means: those with greater financial means spend a smaller proportion of their income and so pay a smaller proportion of it in sales tax. People who support progressive taxation, or even taxation that is flat with respect to income, should generally oppose sales taxes.

But a system in which the rate of sales tax is related to income would be less regressive.

@phoog I would slightly support moving sales tax (actually GST) to income tax just because it simplifies the tax system. But then, I can see situations where some people pay sales tax and not income tax, or vice versa (tourism; savings) so it wouldn't be equivalent. Unfortunately, reality is messy.