The defenders of the GDPR mostly have great faith in their government to enforce vague regulations in a reasonable manner. They're probably right, but: (a) Tha

The defenders of the GDPR mostly have great faith in their government to enforce vague regulations in a reasonable manner. They're probably right, but: (a) That weakens the rule of law. It transfers power from the elected officials who draft and vote on laws to the agencies that enforce them. Most Americans think that's bad, and I agree. (Like, now that Trump is the American president, are you happy or sad that he finds his power limited by the judiciary? How sure are you that your own governments' regulators will always be staffed by people whose judgment you trust?) (b) The extraterritoriality is weird. Let's say Turkey passed a law banning criticism of Erdogan on any website accessible to people in Turkey, and tried to enforce a judgment against an EU national running such a website in the EU. I hope we'd then all agree that's not how international law works. What's the difference between that and the GDPR? Is it just that you think data privacy is good, and banning criticism of Erdogan is bad? I agree, but what's the legal framework here? What countries do you think have the right to impose a similar burden on the EU?