In reply to Mike Schinkel.

Coming back to this rather late but -

As Tim has said, Privacy Shield is indeed opt-in. GDPR is not.

If a business's basis for noncompliance is based on an ideological objection to what they perceive as an overreach of sovereignty rather than the ethics of privacy and data protection, which I believe is called being "disruptive" these days, their option is simple: don't do business with non-US customers.

ICO is running a webinar on Thursday if you would like to get answers from the data protection regulator's mouth. https://twitter.com/ICOnews/status/828574967927148544

In a wider sense, on behalf of approximately ten million people, read up on FATCA and then tell me how you feel about non-US nations trying to "assert authority over others when they have no legal basis to assert that authority" when the US has made millions of non-US people's lives hell, and forced non-US businesses to spend billions of pounds in compliance costs, doing exactly that. Pot kettle.