@Dale Reardon

can’t it be argued that international companies are voluntarily submitting to the EU law by dealing with an EU resident or person physically within the EU?

My point is that all kinds of people can argue all kinds of things. But that's quite different from actual legal weight and ability to enforce. The EU, the government of Belgium, the city of Naples, or Bob from Newcastle could all argue that the moon is made of cheese, but that doesn't mean that anyone else has to care, unless it is also established that they can and will enforce consequences for disagreeing with them.

@Heather Burns' reply to me has not touched on this key point. She's talked about the legalities of who would enforce, in what sense GDPR is new, and other things. But the heart of my question to her is about whether any EU entity (and whether it's the EU itself, or one of its members, is irrelevant) has ever successfully enforced against a non-EU entity (i.e. one without an EU company or sister company, servers or employees), and upon what grounds, and whether they assert the ability to do so with this law, and upon what grounds (i.e. not just hand-waving with the hope of persuading people to do what there's no legal basis for forcing them to do).

Heather seems to confuse my point about sovereign nation states, which (from reading her various comments) appears to be because she feels strongly about the nature of the EU itself, which is irrelevant. The point is not whether the enforcement is centralised or devolved. Its about the inability of *any* entity to enforce law within the boundaries of a foreign, sovereign nation state. For such enforcement to happen, it has to be covered specifically by treaties between the parties involved. I believe that Privacy Shield is only relevant to entities with EU presence - it covers how they exfiltrate data out of the EU, and is enforceable because of their presence in EU. But for companies with no such presence, it is not established that they are subject to it, or upon what basis.

Witness the EU VAT digital VAT law of 2015. This declares that, when digital goods are sold to an EU consumer, then the transaction is deemed by the EU to take place at the location of the consumer (whereas before then, they deemed that it took place at the location of the seller). That's something that you have to care about if you have EU presence. But if you have no EU presence, then it's not necessarily any more interesting or relevant than an EU declaration that Julius Caesar was German.