I'm pretty sure even in the US, sentences for breaking the law vary depending on the case. And what's the point living in civilisation if you can't trust the ju

I'm pretty sure even in the US, sentences for breaking the law vary depending on the case. And what's the point living in civilisation if you can't trust the judiciary? There are options to appeal, so you're not at the mercy of one regulator/judge/<x>. Europe and the GDPR are no different. EU banks not dealing with Americans/FATCA is simply down to it not being worth the effort. Luckily, the GDPR wasn't written in such an absolute way. It doesn't apply to non-EU companies doing business outside the EU, even if they might get the occasional European using their services (unless they specifically go after EU subjects). For example, a Japanese company selling specialty arcade joysticks and I, as a UK resident buy one using yen, not pound sterling. Even though they might ship to the UK, as they ship to loads of places, they aren't doing business in the Union, and they don't have to follow the GDPR.