It's probably the same reason why Hacker News does nothing to comply with the GDPR.
Hacker News can comply with GDPR today and choose not to comply the next day. They forfeit nothing in the process of selectively abandoning GDPR, in regards to being governed by US law and not EU law.
If my company is located in the US and only governed by US jurisdiction (eg I do not operate in the EU in any manner), there's no such concept as admitting the EU has jurisdiction over my company and granting the EU new global powers (such that I can provide the EU jurisdictional reach into the US so that it overrules or competes with US law). That isn't my decision to make if I operate inside the US jurisdiction. The US solely decides jurisdiction within its zone of political control. That is, the US has the final say legally in all regards in that case. I could choose to voluntarily comply with GDPR, however the EU has zero power to force me to. I can flip flop back and forth a thousand times, or not, it makes no difference.
If you ever find yourself wondering about these concepts, change the scenario to China. Under what scenario does the EU or US have power to dictate laws within China? None. It provides a perfect clarification every time. Nobody could possibly be confused about who is in charge of law within China.
However, isn't the idea of forfeiting the personal jurisdiction defense? I am not a lawyer, but from what I understand, once you start debating the merits of the case, you waive the ability to claim that the court doesn't have jurisdiction.
It seems like there's a bit of a chance of that here - once you admit the EU or Chinese legal system is the appropriate place to redress things, you've given up lack of jurisdiction as a defense.
If someone follows that request and if the EU has jurisdiction are orthogonal issues; plenty of services offered deletion before the GDPR.
The question of jurisdiction will come up if you ignore requests or otherwise violate the GDPR and a national agency that is responsible for handling violations contacts you.
In which case you can still choose to ignore them, if you're not on EU soil, then it's up to the extradition or similar laws on what happens; the agency will likely file a court case (or you file), then the court will handle out the details with your national legal system; in most cases this means nationalizing any punishment. Ie, the court case will be handled and if you don't show up after being invited, will be ruled upon in your absence. Then the fine will be forwarded to your country where the courts in your country with your countries jursdiction will then collect it, probably take a fee and then forward the remainder back to the EU. An alternative outcome would be that the entire court case is moved into your country.
Either way, complying to GDPR-related requests doesn't mean admitting jurisdiction of the EU; disagreeing the responsible government agencies involved is a good way to test if those have jurisdiction.
(FWIW yes I do have a law degree)
https://news.sky.com/story/huawei-cfo-meng-wanzhou-facing-ex...
> The global chief financial officer of Chinese phone firm Huawei is facing extradition to the US after being arrested in Canada.
> Meng Wanzhou, who is the daughter of company founder Ren Zhengfei, has been detained in Vancouver in relation to suspected violations by Huawei of US sanctions placed on Iran.
So not only do people have to avoid the U.S. to avoid being subject to U.S. laws, they have to avoid U.S. friendly countries too.
AggregateIQ could have ignored the GDPR-request, ignored any rulings and keep chugging along as long as they stuck to Canada (assuming Canada was not going to side with the EU).
In short, if you're not in the EU, do not care about EU and never will, you can largely ignore the GDPR. Same as if some banana republic dictator declares you persona non grata - if you never intend to visit and otherwise have no business in that country, who cares?
The difference is that the EU is not a banana republic (opinions may vary), and so many choose to respect and accept this their judgement in cases like this to stay on good terms.
That's not entirely true. You can go to a Canadian court to enforce an EU judgement against assets in Canada. So for example, if you cause a car accident in Germany, the plaintiff can sue you in Germany to get a judgement and then sue you in Canada to enforce that judgement. How Canadian (or US or otherwise) courts will treat a GDPR judgement remains to be seen, but it's not a guarantee that it won't be enforced.