In reply to David Anderson.

@David Anderson,

You seem to have a very narrow conception of what law is. You seem essentially to view it as simply a body of rules backed by threats of sanctions for disobedience or non-compliance. Sure, some law is like that. But there is a huge amount of law that isn't.

Some laws are about granting powers (e.g. to contract, get married, etc).

Other laws are much more about changing practices through information and education. When laws were passed mandating the wearing of seatbelts in cars, for example, some people said that these laws were pointless because they could not really be enforced. They were right that the laws could not generally be enforced -- but those laws turned out to be very much on point. They have completely changed the practices of most people riding in cars.

The GDPR should be seen in the same light. The EU isn't really expecting every non-EU person who processes EU data to immediately comply. Heather Burns has already explained that, even when non-compliance comes to light, there's a process to be gone through before any possibility of sanctions arises.

But what the EU is expecting is something like this. Large businesses and government departments will be expected to comply immediately, and there will be plenty of audits to check that they do. Ideally, from the EU's perspective, one of these organizations will make a pig's ear of the whole thing (but without causing harm to anyone) and they can be named and shamed to make a point.

Such publicity will help get smaller businesses to comply, but so will a whole raft of other factors. Big businesses do business with smaller organizations, and they will likely require compliance from those smaller businesses (who will then require it of others, etc.) Similarly, insurance companies will make compliance a condition of coverage, while organizations with an active regulator (such as charities that come under the Charities Commission in the UK, for example) will receive detailed directions on what they have to do. Trades organizations will do much the same thing for their members.

After a while, this will just become the new normal. And it won't make any difference where those businesses or organizations are based. In fact, it will likely become so well known that many people will want to comply even though they are not dealing with EU-based data at all.

This is, in practice, how many laws get "enforced." Now you might ask, to use Carl Hancock's example, what about the small business in Brazil who still doesn't know and doesn't comply. The answer to that is pretty straightforward so far as the EU (or, indeed, any lawmaking body) is concerned. No-one expects perfect compliance. No law receives that. When the police contemplate setting speed traps, they don't give up on the idea just because they won't catch everyone who speeds. And, as noted already, the GDPR really isn't about "catching" anyone; it's about changing behavior through information and education.