It doesn't matter what the EU purports, that's nothing more than a comical fantasy on their part. I live in the US, my business operates in the US, I operate by US law.
It also doesn't matter what China purports I should do with their citizen data, or South Africa, or Australia, or Brazil: their wishes don't overrule the supremacy of US law inside the US. If China wants me to delete everything on my service about Tiananmen Square, or an anti-China activist, guess what, that's not going to happen for the exact same reason. I'm also not subject to the UK government's enforced media blackout on the Tommy Robinson arrest: they too can piss off.
If a EU citizen signs up with my US based service, their data will be governed by US law.
It is that simple. It will remain that simple. The US isn't going to cede its sovereignty to the EU: it's drastically more powerful than the EU in every regard. There is no scenario where the US lays back and allows the EU to legislate how the domestic US economy operates in such large ways.
The only likely outcome is that the US comes up with its own new privacy rules in the next few years, which will be different - more lenient - than GDPR. If you want to operate in the two markets, you'll have to comply with each approach accordingly.
I'd like to think that you're right, but I also don't want to be the guy that has to spend several hundred thousand dollars to defend that thesis in court.
I'm happy to be that guy: the EU doesn't stand a chance and they know it.
It's not a thesis, it's proven, court established rule of law with more than a century of built-up precedence establishing how things actually work when it comes to US sovereignty. This is all quite laughable.
It's identical to saying: well, the US is just going to enforce its freedom of speech approach on Germany or the UK (where offending people is increasingly illegal). So all people and businesses in those nations should disregard their own laws and comply with US laws, you don't want to test the thesis about just how far US jurisdiction extends, better to comply with US freedom of speech laws instead.
Imagine me traveling to Britain and telling them that since I'm an American, their speech laws don't apply to me. I'm governed by US speech laws, regardless of where I'm at. That'd be good for a jolly laugh: look at this delusional, entitled American that thinks they control the planet. Or try telling the Chinese the same thing on their territory.
There are millions of small businesses in the US, very few of them will ever comply with GDPR - even if they have occasional stray EU customers - precisely because the EU has no jurisdiction and those businesses don't operate by EU law.
It also doesn't matter what China purports I should do with their citizen data, or South Africa, or Australia, or Brazil: their wishes don't overrule the supremacy of US law inside the US. If China wants me to delete everything on my service about Tiananmen Square, or an anti-China activist, guess what, that's not going to happen for the exact same reason. I'm also not subject to the UK government's enforced media blackout on the Tommy Robinson arrest: they too can piss off.
If a EU citizen signs up with my US based service, their data will be governed by US law.
It is that simple. It will remain that simple. The US isn't going to cede its sovereignty to the EU: it's drastically more powerful than the EU in every regard. There is no scenario where the US lays back and allows the EU to legislate how the domestic US economy operates in such large ways.
The only likely outcome is that the US comes up with its own new privacy rules in the next few years, which will be different - more lenient - than GDPR. If you want to operate in the two markets, you'll have to comply with each approach accordingly.