What is the legal mechanism by which the GDPR might apply to a business with no presence in the EU?

Question

My family has a small side business selling some things through the internet. As far as I know, we aren't likely to have any customers who are EU citizens, but it's certainly not outside the realm of possibility, and I wouldn't be opposed to shipping to the EU if I got an order from someone in an EU country.

However, in reading about the GDPR, I have mostly seen what appears to me to be bare assertion of the GDPR's global applicability to any business, anywhere, who transacts with an EU citizen.

My business only has a presence in the US. I am not a citizen of the EU, I'm not represented in any legislative body in an EU nation, neither am I represented in the European Parliament. I am not a subject of the EU in any way, shape or form. Why would the EU expect that any of its laws would apply to my business?

More importantly, regardless of what the EU regulators think, how could they possibly enforce any of it against me?

Answer 1

Why would the EU expect that any of its laws would apply to my business?

It doesn't.

Unless you choose to do business in the EU (which is possible, thanks to the wonders of the World Wide Web).

Then, and only then, do you have to comply with EU law, including the GDPR.

From a comment by @BenCollins:

I'm talking about non-EU online retail that does allow Europeans (particularly those not actually in the EU at the time of the transaction) to place orders.

Basically, GDPR Article 3 says that the GDPR

applies to the processing of personal data of data subjects who are in the Union

The phrase "in the union" is clearly open to interpretation, but according to the website Security Now, Dr. Michèle Finck says this:

Most people seem to agree that the relevant criterion is whether you're based in the EU at the moment data is collected - citizen or not (my emphasis).

While Michèle Finck is a well-respected legal scholar, she is not an authoritative legal source, so we need to wait for to case-law to nail this. For what it is worth, (not much I am afraid) I think it would be against common sense to define the territorial scope so broad that brick and mortar stores in the USA risks to be prosecuted in Europe if they sold goods or services to European tourists.

However, what most US based businesses that chooses to be open to business for orders that are placed by natural persons who are in the [European] Union need to know that there is this: According to European law, the GDRP does apply to them when they conduct such business.

From a comment by @BenCollins:

I question the notions that (a) there is a basis by which the law would apply

The legal basis is European law, in particular GDPR Article 3.

and (b) that it has any enforcement mechanisms outside the EU.

As for enforcement, I think a good answer has already been provided by Dale M. but for completeness: The USA has treaties with EU that mean that after a legal case has been decided in a court of law in the EU, it can request that the USA enforce the judgement (typically by collecting the fine the USA-based business incurred when conducting business in Europe).

---

To make this answer more general, here are a breakdown of the the regulation of territorial scope of the GDPR for businesses that are not located in the EU:

The scope is clearly spelled out in Article 3, and if you're not "a controller or a processor in the Union", you are only subject to the GDPR if your processing activities are related to:

a) the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union; or

b) the monitoring of their behaviour as far as their behaviour takes place within the Union.

US based companies that engage in business practices that are illegal in Europe know about this, and has already taking steps to protect themselves from the being prosecuted in Europe under the GDPR by using firewalls to block access to their services from the EU.

The bottom line is that if you:

1. have no presence in Europe, and
2. don't offer goods or services to people who are in the Union, and
3. you don't collect personal data about European natural persons,

then the GDPR does not apply to you. If at least one of the above applies then you need to follow the GDPR if you do not want to be prosecuted in the EU.

Answer 2

Regarding the question of whether your particular small business will need to comply with the GDPR depending on a few things I think the answer may be no. I was recently reading an Australian government document Australian businesses and the EU General Data Protection Regulation that describes how it affects Australian entities. It contains the following examples of businesses that need to comply and I'm sure the same would apply to the US:

• an Australian business with an office in the EU

• an Australian business whose website targets EU customers for example by enabling them to order goods or services in a European language (other than English) or enabling payment in euros

• an Australian business whose website mentions customers or users in the EU

• an Australian business that tracks individuals in the EU on the internet and uses data processing techniques to profile individuals to analyse and predict personal preferences, behaviours and attitudes

That section references Recital 12 that includes the following paragraph:

In order to determine whether such a controller or processor is offering goods or services to data subjects who are in the Union, it should be ascertained whether it is apparent that the controller or processor envisages offering services to data subjects in one or more Member States in the Union.

Whereas the mere accessibility of the controller's, processor's or an intermediary's website in the Union, of an email address or of other contact details, or the use of a language generally used in the third country where the controller is established, is insufficient to ascertain such intention, factors such as the use of a language or a currency generally used in one or more Member States with the possibility of ordering goods and services in that other language, or the mentioning of customers or users who are in the Union, may make it apparent that the controller envisages offering goods or services to data subjects in the Union.

Which seems to backup the Australian government's interpretation that if you just use your local currency / language rather than specifically targeting the EU by means of currency, language or mentioning the area specifically you shouldn't need to comply. You would have to be careful of the last point of analyzing and predicting personal preferences if you are using some sort of web store that shows "products you may like" pages that are based on a user's past behavior.

I imagine the exemption has been put in place to handle the millions of businesses on the Internet that have a fairly inconsequential number of customers in the EU who might otherwise simply stop selling goods and services to the EU.

Answer 3

If your business breaches the law in say, France, the French government can prosecute it in a French court. Assuming they win (which is likely if you don’t defend the prosecution), the US has treaties with France that means (with some exceptions) the French government can seek enforcement in a US court.

That���s how.

Answer 4

I'm not a lawyer, I'm thinking of norms of international law (which are above treaties), and allowing that treaties can create some kinds of exceptions, but this looks like a case of overclaiming legal rights by the EU. The EU might be allowed to claim jurisdiction because of use of euros, which in a sense are property of the EU (much as the US has the right to forbid money laundering using dollars), but not because of language, because, e.g., France does not own French, no one does, even though France through L'Académie française sets standards for proper French. The EU can forbid its citizens from buying from US businesses but cannot bar US businesses from selling to the EU citizens. From the above posts, it appears litigation in and out of the EU will have to set boundaries on the GDPR's applicability. While treaties apparently provide for international enforcement, the US put an end to libel tourism in the US after someone won a case in the UK against a book with sales of about 27 copies due to concession and then tried to stop book sales in the US where sales were large. So a domestication treaty may be subject to a similar limit and I suspect the US Congress or states will legislate a limit on the GDPR's reach, setting the ground for litigation. The notion that foreign monitoring of someone's public activity can be banned by the EU means that US citizens reading about the heads of state of EU nations would be violating the law; you can imagine how far an effort to enforce that ban would get in the US. Imagine the EU suing CBS-TV or NY Times for monitoring EU public figures or private citizens such as by interviewing a Berlin shopkeeper. So, to answer the original question, if the poster has no additional connection to EU, he probably is not under EU jurisdiction even for sales to Europeans, but he should stay in touch with news reports of litigation to see how things shake out.