In reply to Heather Burns.

GDPR is different to the UK's long-standing DPA. They are different in breadth of reach and application:

1) GDPR has global reach, DPA did not
2) GDPR covers persons in EU territory however temporary their stay in the EU,
3) GDPR makes the original collector (and agent of) responsible for actions committed by 3rd parties all the way down the chain so who A shares with (e.g. B), who AB share with and who ABC share with etc..,
4) GDPR makes any data collection entirely opt-in, DPA did not
5) GDPR requires a data processor or data holder to provide a method for a Data Subject to have data held about them erased or transferred to another data processor/controller upon request,
6) GDPR allows for group law suits or for others to sue on behalf of those affected by non compliance
7) There are many other differences between GDPR and the DPA.

Here are 2 brief summaries of some of those differences:

1) https://www.atg-it.co.uk/gdpr/dpa-vs-gdpr/
2) https://www.ebuyer.com/blog/2017/03/the-difference-between-gdpr-and-dpa/.

The UK's ICO has this to say:

1) https://ico.org.uk/for-organisations/data-protection-bill/

GDPR is a tortuous beast compared to DPA. So much so that even ICANN is in the process of changing its domain registration privacy policies, and we all know how arrogant ICANN is.

You are correct about the fines. The Tier 1 fine scale is between 4% of global turnover and €20 million. The Tier 2 fine scale is between 2% of global turnover and €10 million. I am happy you corrected me there. Thank you for pointing out this error in my knowledge.

Many conversations and reports about the possible fines add 'whichever is greater' to their statements about them, which I suspect is due to mistranslation of earlier information put out by the EU Commission, or misproduction by the Commission's website authors. It is mentioned too often for it to be made up out of nowhere by each author. The authors could be parroting each other though I do recall reading that statement on the Commission's website too. The page about GDPR that I bookmarked appears to have been edited since my last visit (I know I saw it. Promise). I visit the Commission's site more often than I would prefer to need to do. I am accustomed to its pages being moved and to page content being edited or entirely replaced between visits.

The following (current) official texts are enlightening:

1) https://ec.europa.eu/info/law/law-topic/data-protection_en
2) http://eur-lex.europa.eu/legal-content/en/TXT/?uri=CELEX%3A32016R0679

GDPR and the UK

GDPR will be brought into UK law and will remain in UK law after the UK leaves the EU. I understand that how it is applied will be down to UK law, which is different in basis and process to EU law. The latter being based on the Napoleonic Code of 'you have the right to do...' and the former being based on the English Common Law premise 'You have freedom from...'

GDPR will not necessarily escape change when reviewed by UK Ministers and the ICO post Brexit. GDPR's post Brexit continued relevance to domestic UK law is not a done deal. Reading the updated DPA (details linked to above), it is very likely UK GDPR will be rewritten.

Geoblocking

Geoblocking with regards to digital service provision has been illegal in the EU for some time. Europe and the EU are different entities. The EU is a legal construct. Europe is a physical landmass i.e a continent. Once the UK leaves the EU, UK citizens will not be bound by EU law. I will be legally able to geoblock EU traffic when the UK leaves the EU. I am not alone in this reverie. I certainly will not allow EU law to prevent me geoblocking whichever regions I choose to block -- I control my data ;)