GDPR is a hot topic since it will start being enforced from 25 May 2018.

One of the most important characteristics of this regulation is that it also applies to companies outside the EU:

A major change made by the GDPR is the territorial scope of the new law. The GDPR replaces the 1995 EU Data Protection Directive which generally did not regulate businesses based outside the EU. However, now even if a US-based business has no employees or offices within the boundaries of the EU, the GDPR may still apply. (..) The GDPR imposes significant fines for companies that fail to comply.

However, it is not clear how the EU can issue a fine for a company that has no physical presence in the EU. Assuming some US company breaks this regulation and has no physical presence within EU territory, how can it be fined?

My assumption is that there must be some kind of US-EU treaty that can be used, so that fines can actually be issued.

I found this article about EU-US Privacy Shield that seems to be related to GDPR. It seems to have some issues related to Cross-Border Data Transfers:

Though the United States has worked extensively with the European Commission on data security standards, it is not considered an Adequate Jurisdiction by the Commission

Anyway, it is not clear if this program is the missing link I am looking for.

Question: How are GDPR fines actually enforced for companies with no physical presence in the EU?


5 Answers 5


Your assumption of a US-EU treaty to enforce fines seems like it is one of two intended enforcement methods, the other being the required establishment of representatives to ensure non-EU entities have at least some physical presence in the EU.

The GDPR requires non-EU entities handling EU data to appoint a representative in the EU, and this representative will be able receive the fines or other penalties relating to regulation compliance. In case that doesn't work, according to the text of the GDPR, the enforcement authorities will work with non-EU countries and international organizations to develop exact enforcement methods, rather than having such methods be part of the GDPR itself.

Enforcement Outside EU: Chapter 5 of the GDPR relates to handling of data by non-member countries or organizations. The relevant text relating to enforcement of fines is from Article 50, titled "International cooperation for the protection of personal data":

(1) In relation to third countries and international organisations, the Commission and supervisory authorities shall take appropriate steps to:

a) develop international cooperation mechanisms to facilitate the effective enforcement of legislation for the protection of personal data;

b) provide international mutual assistance in the enforcement of legislation for the protection of personal data, including through notification, complaint referral, investigative assistance and information exchange, subject to appropriate safeguards for the protection of personal data and other fundamental rights and freedoms;

c) engage relevant stakeholders in discussion and activities aimed at furthering international cooperation in the enforcement of legislation for the protection of personal data;

d) promote the exchange and documentation of personal data protection legislation and practice, including on jurisdictional conflicts with third countries.

That's it. Basically, their method of non-EU enforcement seems to be "we'll figure it out". Depending on what 'appropriate steps to develop international cooperation mechanisms' means, it appears like treaties or others agreements will be the mechanism for enforcing the GDPR outside the member states.

Representatives As Means of Enforcement: Article 3 states that the scope of the GDPR covers any data sourced from the EU, regardless of it is actually processed or used there. Article 27 covers the appointment of representatives for non-EU entities, and applies to whatever entities Article 3 applies to. The relevant text from Article 27:

(3) The representative shall be established in one of the Member States where the data subjects, whose personal data are processed in relation to the offering of goods or services to them, or whose behaviour is monitored, are.

(4) The representative shall be mandated by the controller or processor to be addressed in addition to or instead of the controller or the processor by, in particular, supervisory authorities and data subjects, on all issues related to processing, for the purposes of ensuring compliance with this Regulation.

(5) The designation of a representative by the controller or processor shall be without prejudice to legal actions which could be initiated against the controller or the processor themselves.

Basically, non-EU entities which process or control EU data will need to establish a representative/proxy entity in at least one of the member states where they source the data. This representative will, unsurprisingly, represent the non-EU entity in all matters relating to regulation. According to this explanation(and some others I've seen), this means the representative will be subject to any compliance issues, including enforcement of fines.

Presumably, there are mechanisms already in place stopping entities from creating a representative, getting a fine, having the representative declare bankruptcy, and just setting up a new representative.

  • 1
    Regarding representative s declaring bankrupcy, not sure if this applies,but the directive specified that fines are applied across company groups, can be and up to,I believe, 5% of group's turnover. Meaning, as I understand, if Microsoft Germany breaks law, EU can fine Microsoft up to 5% of Microsoft's global turnover.
    – Gnudiff
    Commented Apr 20, 2018 at 8:24
  • 8
    What reason would a non-EU country have to want to cooperate with international regulators, against their own citizens? And even if the GDPR requires companies to have representatives in Europe, that just changes the question to how that would be enforced.
    – Sparkette
    Commented May 24, 2018 at 19:38
  • 3
    @Gnudiff But they can only fine the 'representative'. Surely, according to EU law the fine is calculated on annual global turnover (4%, not 5%), but once bankruptcy kicks in for the 'representative', what mechanism is put in place to get access to the parent company? Commented Jun 4, 2018 at 10:45
  • 2
    Take these news sites that are blocking access to EU citizens as an example. Suppose they do not have any 'representatives' or subsidiaries in the EU (I do not know). On which legal ground would you sue them? Certainly, sanctions can be put in place, like blocking access to their websites from within the EU (already quite drastic/unlikely for small companies). It seems a bit backwards to prevent this from happening by voluntarily blocking access to users from the EU. Commented Jun 4, 2018 at 10:52
  • 4
    A direct response from AU attorney general's office to me says the AU government will not honour laws that conflict with current AU law. Aka Australian privacy law only applies to AU businesses, not GPDR. AU govt will not currently enforce any fines for Australian business. As for forcing a representative within the EU, once again, it's unenforceable in AU.
    – Dawesi
    Commented Jun 17, 2018 at 9:52

To complement Giter's excellent answer, procedures to collect internationally already exist through the typical judicial channels. In a nutshell, the judge issuing the fine in the EU would forward the case to a judge in the company's country, and the latter would then consider whether to enforce the collection or not.

Fined companies could fight the collection for all sorts of reasons, just like individuals would fight an extradition request. And you can bet that some will.

Whether they'll actually win is anyone's guess until there's case law specific to the issue. But generally speaking, EU judgements have a non-zero chance of getting enforced in a lot of countries. It's not like the EU is some theocracy asking foreign companies to comply with Sharia law or a dictatorship issuing death sentences left right and center. EU members are in good standing with most of the world and their justice systems are mostly well respected.

Reciprocity also kicks in: if a country's judges don't enforce EU judgements, you can bet EU judges won't be too keen on enforcing theirs; and vice versa. (Speaking of which, in the particular case of the US, EU judges don't like punitive damages so much.)

  • 3
    On the other hand, the GDPR is not exactly the same as the problematic foreign laws that prompted the SPEECH Act in the USA, but it's similar enough that it doesn't seem implausible that the USA would establish a similar shield. Commented Apr 20, 2018 at 13:16
  • 5
    AU has already declared it WILL NOT enforce GPDR rulings for AU businesses that are run from Australia.
    – Dawesi
    Commented Jun 17, 2018 at 9:53

Article 50 implies there is no way to force compliance in third countries, but there would be dialogue with the authorities of the third country to encourage compliance.

For example:

In relation to third countries and international organisations, the Commission and supervisory authorities shall take appropriate steps to:

(a) develop international cooperation mechanisms to facilitate the effective enforcement of legislation for the protection of personal data;

Subsections b)-d) have similar sentiment.

  • 7
    In other words the US government could shield it's companies from this gigantic regulation if it wants to. Commented Apr 19, 2018 at 15:20
  • 4
    It could try that, the consequences would be interesting to follow. I imagine the fine would then be enforced locally with the company either forced to quit the local market or follow through under new conditions.
    – zrooda
    Commented Apr 19, 2018 at 16:03
  • @JonathanReez: And the EU could then ban all US companies without EU presence from doing business in the EU. It's often possible to turn Law into Politics, but the risk there is that you're turning Law into Politics.
    – MSalters
    Commented Apr 20, 2018 at 8:30
  • @JonathanReez Not really, all this discussion pertains to a mythical US company “with no physical presence in Europe”. In reality, there wouldn't be many, certainly not very big ones and I doubt they are a main focus of the GDPR. I don't think the language about seeking cooperation is about enforcing fines, incidentally.
    – Relaxed
    Commented Apr 26, 2018 at 6:57

I believe that, at least in the UK, the relevant authority could get a court order which names the senior management in the company as being personally responsible. If the company fails to comply then when any of those individuals come to Europe they will be risking arrest for contempt of court.

In the past the US has ordered banks and credit card companies to stop doing business with targeted organizations such as Wikileaks and gambling companies. I don't know if the EU could do that today, but I'm sure it could create a regulation enabling that if lots of foreign companies decided to become scofflaws.

  • Deliberate restriction of trade is a direct breach of several free-trade agreements. EU wouldn't be bothered with anyone but huge enterprise anyway as cost isn't worth it. You could just declare bankrupsy 5 minutes after starting a new business that bought customers from old one. ;-)
    – Dawesi
    Commented Jun 17, 2018 at 9:55
  • @Dawesi Its not restriction of trade if the target is breaking the law. After that it gets complicated, but if enforcing privacy legislation was a breach of WTO rules then I'm sure we'd already have heard about it WRT Privacy Shield. Commented Jun 17, 2018 at 11:35

Enforcement of EU fines issued under GDPR would be by the use of international law - essentially the US courts would recognize the legitimacy of the EU fine and enforce it (this may require a secondary action to be brought in the US court.

My company provides the Representative service mentioned above, where we act as the EU-facing presence for a non-EU client, I'd be happy to discuss with anyone who's curious about this role.

I found this article which is relevant.

  • 4
    "essentially the US courts would recognise the legitimacy of the EU fine and enforce it." Why would they do that, though? Commented Apr 30, 2018 at 17:29
  • 2
    And why would a non-EU firm establish a representative EU-facing presence to comply with the regulation in the first place? If they don't provide such a representative in the EU, what then? What is their motivation to employ you? Commented Aug 19, 2018 at 1:54

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .