International enforcement is a can of worms. However, a lot of it is covered by: 1- US companies with a physical presence in the EU. They can fine that entity

International enforcement is a can of worms. However, a lot of it is covered by: 1- US companies with a physical presence in the EU. They can fine that entity directly. 2- US companies will find they can't sell to EU businesses (B2B), as that means the EU company is carrying the can in terms of non-compliance. 3- The EU Member State could go via the International Courts. Or via some kind of bilateral agreement (e.g. Privacy Shield). I expect #3 will need to egregious to really make sense. However, I also expect a significant amount is already hovered up by #1 or #2. Certainly many of the cases that GDPR wants to target. Additionally, the EU may cut deals with other states to bring in enforcement powers (fines).