gdpr international european-union
As of 2020, have any GDPR-related court judgements been successfully enforced on companies without presence in the EU?
<p>The GDPR has been in effect for 2 years now and theoretically applies to any company on the planet which deals with personal data belonging to EU residents. But practically speaking, enforcing this law should be quite difficult, as EU authorities have zero direct enforcement power over foreign corporations without EU assets.</p>
<p>Here's a scenario that would satisfy the requirements of this question:</p>
<ol>
<li>A website was operating outside the EU, with no EU legal entity established and no payments accepted from EU users</li>
<li>An EU court ruled that they must still comply with GDPR because they happen to have visitors living in the EU</li>
<li>Said website ignored the EU court ruling entirely, refusing to comply</li>
<li>The EU managed to convince the authorities of the country where the website is located to enforce the judgement on their behalf</li>
</ol>
<p>I'm interested in any country outside of the EU, EEA or the UK where this happened.</p>

<p>EU Member State Data Protection Authorities (&quot;<strong>DPAs</strong>&quot;) have fined foreign legal entities (pursuant to Articles 58(2)(i) and 83 GDPR and further national provisions), however it is not publicly documented whether the specific situation you described has occured. Even if such situation would arise, I would think that it is unlikely that DPAs imposing administrative fines could enforce their (fine imposing) decisions outside the EU, even if the decision in question was confirmed by a court. For instance, in the Netherlands there is not a strong legal basis for the (mutual) recognition and enforcement of foreign administrative decisions. I could imagine that the same applies to other EU Member States.</p>
<p><strong>However, please note (possible) civil liability</strong></p>
<p>Your question seems to refer to enforcement of the GDPR under instruments of administrative / public law. Please note however that the GDPR can also be enforced by private individuals and organizations, e.g. through tortious liability claims. See for example Amsterdam District Court 2 september 2019, ECLI:NL:RBAMS:2019:6490 for a situation (albeit purely national), in which the Court awarded damages for a GDPR breach to a data subject. Possibly, a similar case could be brought against an entity outside the EU that processes data of EU data subjects, contingent upon the outcome of certain questions of International Private Law. With regard to civil damages, there is an extensive international legal framework that covers the cross-border enforcement of rewards for civil damages. Likely, such rewards for damages could more easily be enforced outside the EU. However, I must note that such (private) cross-border enforcement of the GDPR has not happened in practice (yet) either (as far as I know).</p>
<p><em>(Please note that this answer assumes (per the question) that the GDPR is applicable and only deals with the question of the territorial aspects of subsequent enforcement. See about the territorial scope of the GDPR: <a href="https://law.stackexchange.com/questions/28676/what-is-the-legal-mechanism-by-which-the-gdpr-might-apply-to-a-business-with-no?rq=1">What is the legal mechanism by which the GDPR might apply to a business with no presence in the EU?</a>).</em></p>
