In reply to Tim Kaye.

Sorry, Mike, you’re a great developer, but you’re not so hot as a lawyer!

That is absolutely correct, I am not a great lawyer because I am not a lawyer! As an aside, I do appreciate the compliment on my development ability but I know that was not your reason to reply.

That said, I am MORE than happy to learn that I was wrong on this. That is why I asked Heather so many questions. My sole interest here is to clarify the facts, in large part for my own needs but in small part to have a definitive place to point others on the subject since I know advocates for GDPR will debate the subject here until we arrive at the real facts of the matter.

... But the GDPR remains mandatory.

Second, your points on Twitter didn’t get the definitive answer you wanted because you weren’t asking the right question. You kept asking about enforcement. But that’s not the same thing as whether the GDPR applies to US businesses with European users.

Just because a motorist repeatedly exceeds the speed limit without getting caught doesn’t mean that there is no speed limit. In fact, there is no doubt that the GDPR does apply to US businesses with European users.

I probably worded my comment poorly.

But based on what I currently understand I believe the ramifications are still the same. You and I are possibly debating the difference between what the law states and where the EU has jurisdiction; the latter of which is really what effectively matters. Let me explain by analogy.

Law is based on precedent, at least in most of the US and (not Louisiana!) and most of Europe (I assume). In the USA (at least) there is a concept of "Nexus" related to need to collect sales tax on behalf of a US state.

So if someone runs a business in the State of New York and sells consumer items then they need to collect sales taxes when they sell those items to New York state residents, even if they sell online. If they sell items retail via a store located in New York state then they must also collect sales tax for the State of New York anytime someone visits their shop and buys items, even if the buyers are not residents of New York (this differs from European VAT, from what I understand.)

Now the State of California may decide to pass a law that anyone who is a California resident must pay California sales tax on anything they buy. But sales taxes are collected and enforced on the merchant, not the user, so this law effectively tells a New York-based company that they must collect sales tax on all of their online sales to residents of California. And that applies legally if the New York-based company has a store in California.

But the problem for California is when this New York company does not have a Nexus in California where Nexus is defined as having a "physical presence." So if the New York company only has a physical presence in New York state then the State of California is left wanting.

YES, this hypothetical California law is clear; according to this hypothetical the New York company must collect sales tax on California residents and then pay that tax to the State of California. But without Nexus, the State of California has no jurisdiction over the New York-based company thus the law is effectively moot. If the US Congress ever passed a federal law that required organizations to collect sales tax for all states then yes, a New York-based company would need to collect for California. But that has not (yet?) happened.

It was with exactly this knowledge that I was suspect of the assertion that GDPR effectively applies to all organizations, even those outside of EU's borders. I ran a catalog mail order retailer in the states for over 10 years and while IANAL, we sure spent a lot of money for legal advice over those 10 years, so I do know a fair bit about about inter-jurisdictional law as long as precedent still holds.

(emphasis mine):

There are many ways that the GDPR might be enforced against a US business, just as there are many ways that European governments might seek to collect VAT from US businesses that sell to customers in the EU. How they choose to do so is up to their imagination

Can you name just one way?

In answering your reply I discovered that it was not googling "nexus" that revealed the answers so much as googling "jurisdiction." So it comes to this: does the EU have jurisdiction to hold organizations outside of the EU accountable to the GDPR law?

YES the EU can claim it's law applies but can the EU actually enforce the law outside the EU? As a non-sensical analogy, I can assert you owe me money for my time because of the time it took me to reply to your comment here but does not actually mean you owe me money just because I asserted it? No, I have no authority over you. I can send you an invoice, but who would enforce my invoice on you? No one. At least no one using the law.

Anyway, according to the American Bar Association on GDPR (emphasis mine):

Data protection authorities will also be able to enforce penalties against the local representative of a non-EU data processor or controller, effectively giving those authorities indirect jurisdiction over non-EU data processors. (However) The GDPR has no means of enforcing penalties against non-EU processors who fail to appoint a local representative, which may lead some U.S. data processors to consider whether appointing a local representative simply invites more risk.

And more on those "local representatives" (since, my questions really revolve around small and micro-businesses where compliance would comprise too large a part of their budget to allow the company to be viable, emphasis mine):

Companies that only engage in “processing which is occasional, does not include, on a large scale, processing of special categories of data as referred to in Article 9(1) or processing of data relating to criminal convictions and offences referred to in Article 9a, and is unlikely to result in a risk for the rights and freedoms of individuals, taking into account the nature, context, scope and purposes of the processing” are not required to appoint local representatives.

So even per the way the GDPR was written it appears that GDPR in fact does not apply to all non-EU businesses, which even exceeds the original point I was trying to make.

Again, I don't have an issue with the GDPR per se. I have an issue when governments or organizations or people try to assert authority over others when they have no legal basis to assert that authority.