So if I’m an American company and have no offices in Europe and ignore GDPR for my free customers, what happens? Will I get arrested by the Polizei when I land in Berlin? Will the US force me to pay these fines?
How are these treaties enforced? All international treaties are ultimately based on trust. There is no higher authority, only elective councils of and voluntary commitment to procedures (a.k.a. promises) by sovereign states.
Specifically not even these formal promises have been given by e.g. the United States of America which to this day has signed but never ratified either the VCLT[1] or the VCLTIO[2], so is figuratively giving a lukewarm "let's see about the convenience of that when it comes up".
1: https://en.wikipedia.org/wiki/Vienna_Convention_on_the_Law_o...
2: https://en.wikipedia.org/wiki/Vienna_Convention_on_the_Law_o...
if a EU user is in the US ON HOLIDAY! and they're using your service, you're subject to the GDPR
(in theory)
A bit more unclear situation is if non-resident is visiting EU and uses services from their home country.
given "within the Union" is used separately in the next sub-article to mean physically located within, it's arguable that "in the Union" could mean citizen of
> Will I get arrested by the Polizei when I land in Berlin?
Maybe also this.
> Will the US force me to pay these fines?
I am also curious.
This happened a long time ago. And it was started by the US, I'm quite sure.
More than that, the American way to manage the "global network" is basically to impose US laws everywhere in the world.
You can receive DMCA notices outside the US, for example.
Or even crazier: https://en.wikipedia.org/wiki/United_States_v._Elcom_Ltd.
Someone arrested, in the US, for a "crime" in another country, that wasn't even a crime in his country.
So it's an example of "law enforcement can and sometimes do illegally attest / cause other issues unfairly", but not really a good example of a law being imposed outside the country which made that law.
Also the fact that many major tech companies are American means that US laws are basically enforced on all of their users, which is super crazy.
Including stuff like...
https://en.wikipedia.org/wiki/CLOUD_Act
> The CLOUD Act primarily amends the Stored Communications Act (SCA) of 1986 to allow federal law enforcement to compel U.S.-based technology companies via warrant or subpoena to provide requested data stored on servers regardless of whether the data are stored in the U.S. or on foreign soil.
This includes foreign based subsidiaries!
So if the US Gov decides that Facebook needs to give something over, everything and everyone owned by Facebook, everywhere around the world, needs to comply. So Facebook Zambia needs to hand over the data to Facebook US. On paper there are some protections, but I'd really, really want to see how well they're enforced (I doubt it).
It's so bad cloud providers have pages about it:
https://aws.amazon.com/compliance/cloud-act/
Where they basically say: "yeah, it's true, we'll fight in a court of law on your behalf, because otherwise a huge chunk of you in other countries would never use us".