Politics Stack Exchange is a question and answer site for people interested in governments, policies, and political processes. It only takes a minute to sign up.
Sign up to join this community
The upcoming General Data Protection Regulation of the EU has some strong provisions including penalties for mis-managing data.
I don't understand though how it can be enforced outside of Europe, as the EU isn't sovereign, what authority does it have to prosecute others? Also, as this isn't an international treaty that other nations join, why should a company in a non-European country care?
Usually, the way that the European Union works is to set standards that member nations must follow though its internal political processes (e.g. the European parliament and European commission and specialized areas) that it is a mandate to do under a general E.U. treaty.
Once those standards are set, E.U. member nations are required to adopt domestic legislation or regulations that implement those standards in their own legal system. Then, the laws or regulations mandates by the E.U. are enforced like any other law or regulation of the member country.
Often the domestic legislative of a country applies not only to people in the country that enacts it, but also in any country that does business with the country that passed the law, and generally, someone who does business with a country is subject to the jurisdiction of its laws in its courts.
The failure of someone in a non-European country to comply could lead to a lawsuit against them in Europe and a seizure of their European assets (and the person's assets in any of the many other countries in the world that recognizes the judgments of European courts), and might, in general put that person in a position of complying with European laws and court judgments, or not having any practical ability to do business with Europeans at all.
It works the same way as FATCA, any number of technical norms regarding food safety, quality standards, etc. or, for that matter, Chinese censorship. If you want to do business in Europe, you have to comply.
Even if you put aside current R&D sites and assume they could be moved elsewhere, pure online players based in non-European countries (think Facebook or Google) need a significant presence in Europe to operate (sales, billings, etc.) EU countries could therefore seize these European assets but it seldom comes to that.
So in practice, smaller businesses with absolutely no footprint in Europe might be able to get away with ignoring the rules but that's not realistic for large(er) companies. And large online businesses cannot ignore a market as big as the EU.
The EU has data privacy with the US and will take US companies to international court under these rules and since the US and EU cooperate together they will more in likely allow it. For Canadian companies - CETA will more in likely make them compliant with data security.
