gdpr
Extraterritorial Scope of Brazil&#39;s LGPD
<p>How can a national legislation, like the recent Brazil's LGPD apply to companies which are not established in Brazil, but may offer services to Brazilian citizens via the Internet?</p>

<p>Imagine a website (hosted outside Brazil) never tracks the location of its registered users (which can easily be altered anyway using a VPN). How can Brazil even enforce the application of its national laws in such cases? What can it do if the company in question simply refuses to comply?</p>

<h2>Like this</h2>

<p>Let's assume that the perpetrator is a California based company.</p>

<ol>
<li>The Brazilian government initiates a prosecution in Brazil.</li>
<li>It follows its proper course and the company is convicted and the judge orders a fine of, say 5 million Real.</li>
<li>The Brazilian government takes this judgment to a Californian court who determines that the case was conducted correctly under Brazilian law. This would be a judicial review and not a retrial on the issues. Further, they would check that the matter was not in conflict with ant treaty between the US &amp; Brazil about such matters.</li>
<li>If the Californian court is satisfied that this was done correctly, it issues a judgment for the same amount in USD.</li>
<li>The Brazillian government then collects against that debt using all the normal methods in California. Refusal by the company to pay will now be contempt of court in California.</li>
</ol>

<p>Virtually every country in the world reciprocally enforces judgements for other nations.</p>

<p>By the way, there is no extraterritoriality in the offence: the offence was committed in Brazil and prosecuted in Brazil, the enforcement is under US law in California.</p>
