In reply to Carl Hancock.

@carlhancock

"I would say given the fact the EU could attempt to fine the site owner in Brazil for not even knowing what the GDRP is in order "

That is not how the compliance process works, and it's certainly not how the enforcement process works.

What would happen is that (say) an Austrian using a SAAS from Brazil would have a concern about how that company is using, processing, and sharing their data. The Austrian would examine the Brazilian company's privacy notice and subject access request process to learn what they are doing. The Austrian either doesn't find what they're looking for or learns that the Brazilian company is noncompliant. The Austrian can get in touch with the company personally to have their concerns addressed. If the Austrian is still not happy, they can raise a concern with their national data protection regulator (in this case, Austria's) who will liaise with the Brazilian company.

Anything after that is a four stage process between the Austrian DP and the Brazilian company with a view towards bringing the latter into proper compliance with the personal data they hold and process about Austrian citizens. The process is constructive and supportive, not threatening and adversarial.

Under GDPR, fines are only imposed on companies which outright refuse to comply, repeat their mistakes, or have committed a truly egrigious violation of data protection such as we saw with the BPAS hack. Fines are imposed by national regulators, not the EU. The fines you've seen the EU impose centrally onto Apple et al are for tax trickery, not data protection.

There's a lot of #GDPRubbish going around and one unfortunate myth is that the EU is some central government monolith that's going to be stomping around throwing giantic fines on non-EU companies. That simply is not how it works. The purpose of GDPR compliance is not supposed to be about avoiding fines in any case: it's about protecting user privacy. It's the price of doing business in Europe.