There's lots of bullshit in legal journals too, partly due to how most of those journals are student-reviewed rather than peer-reviewed, and partly due to how politicized the legal academy is. Care to provide a cite?
> I'm not exactly clear what you are saying here, but in any event, at least in any interpretation I can think of, the analogy doesn't map. If a UK entity sues a Brazilian in a Brazilian court, that's all pretty normal. That's just the UK entity doing something they are able to do in compatible courts, that's not UK law applying to Brazilians.
No, I'm saying that a UK entity can sue a Brazilian for defamation in UK court, not Brazilian court, and win jurisdictional arguments in the UK court based on the Brazilian's publications being targeted to the UK - even if the Brazilian has never been to the UK. And all of this would be based on UK law, not Brazilian law.
> And how is this relevant? That foreign defendant would be present in Quebec to be tried,
I said nothing about the foreign defendant being present in Quebec, no. Everything I said applies even when that is not true.
> so it's quite a bit different from the EU claiming Joe Schmoe halfway around the world who has no interest in the EU or Europe and has never been there, is subject to EU law because an EU citizen visited their data collecting site. > [...] > The attempt to target the EU would be simply be having online advertising that would show up in the EU.
This is among the common global misinformation about the GDPR that does not reflect the EU's actual legislation or their actual guidance about the GDPR. Read Article 3 of the GDPR or Recitals 23 and 24 of the official guidance about it.
https://gdpr-info.eu/art-3-gdpr/
https://gdpr-info.eu/recitals/no-23/
https://gdpr-info.eu/recitals/no-24/
(Note, that website is not an official source, but it's a more convenient way for me to link to the relevant sections than the official sources.)
Merely not blocking online advertising from showing up in the EU does not cause GDPR to apply. Nor does merely receiving a visit from an EU citizen.
However, monitoring behavior by visitors where that behavior occurs in the EU does. So if a website's preferred online advertising model depends on monitoring the behavior of their visitors and they don't want to make an exception to that for visitors in the EU, that's the source of the GDPR applicability - not the online advertising itself.
And I already explained why this is necessary to avoid a huge truck-sized loophole.
> I don't think this is the actual text of the law. The EU claims GDPR applies to a small data collecting site, say, in Vietnam, that wants to store and retain and sell all the data it can about anyone that visits its site. That's what is ridiculous, that's what is incomparable to anything else you have listed.
Again, read Article 3 of the GDPR and Recitals 23 and 24 of the official guidance. The EU does not claim the GDPR applies there.
> But in any event, let's say that is the law. Let's say this site in my Vietnamese example goes out of it's way to target the EU, having French and Spanish as default languages, having language flags for every EU country, and paying for advertisements (but only on US sites with US companies, lets say, just to reinforce the point that no business has been done in the EU) - well, in that case, it's still bonkers that the EU thinks they have any jurisdiction over the operator of that site.
You would be amazed at how many countries would apply their jurisdiction to foreigners with respect to how many laws in this kind of scenario. People have been persuaded otherwise by anti-GDPR propaganda by the industries that depend on routinely violating the GDPR, but it's really true.
In particular, look at this summary on Wikipedia of personal jurisdiction in Internet cases in the United States:
https://en.wikipedia.org/wiki/Personal_jurisdiction_in_Inter...
Many, many, many of those scenarios can happen when the out-of-state website operator has never been to the US and is not a US citizen or company. The phrase "purposely availed itself" in that US jurisprudence is very similar to what I was calling targeting the EU in my previous comments.
More information on the underlying principles and laws, again from the US perspective:
https://en.wikipedia.org/wiki/Minimum_contacts
https://en.wikipedia.org/wiki/Long-arm_jurisdiction
> The ONLY thing they can do is firewall it off, like China does. That's it. Claiming to have global jurisdiction as they do just makes them look foolish.
They claim just as much jurisdiction as most countries do - but most countries don't have privacy laws like the GDPR, so the industries who are crying about the GDPR aren't crying about most other examples.
> There is absolutely no instance of a foreign court upholding a GDPR fine and I don't expect there ever will be, nor is there any treaty that would allow for that as far as I know. If you know otherwise and could name such a treaty I would appreciate it.
Small correction to my previous comment: while there are indeed some multilateral treaties about the recognition of foreign judgments such as can happen for unpaid GDPR fines, you're right that the US isn't part of those treaties.
However, US state laws do allow recognition of many foreign judgments, with the details varying widely. There is a federal law which prohibits US enforcement of foreign libel judgments that would violate the First Amendment if they had been from a US court, but there is no federal law restricting states from recognizing most other foreign judgments they might choose to recognize. And again, in many cases states do so choose.
I would be quite surprised if all US states would never enforce a court judgment from an EU country resulting from a GDPR violation. Said differently, I expect that at least some US states would enforce such a judgment under at least some facts and circumstances.
> The only thing the EU can do is get a judgement against that person or company and arrest people if they enter the EU, firewall off hosts, or police and punish its own citizens.
Even when the company has no assets in a jurisdiction that allows recognition of EU judgments resulting from GDPR violations, they can also seize movements of money or goods into or out of the EU which belong to the company that isn't paying the judgment.
Anyway, "police and punish its own citizens" isn't the scenario being discussed here - nobody violates the GDPR by accessing or using a website that violates the GDPR. The violation is the website's alone.