something not having caselaw doesn't make it illegal. it just means it's untested. In this case I believe @jahewson is correct. They just can't legally _punish

something not having caselaw doesn't make it illegal. it just means it's untested. In this case I believe @jahewson is correct. They just can't legally _punish_ you for violations until you enter the EU. You've still broken the law in the EU by not handling the data of a EU citizen as legally required by anyone who does business with them. I understand where you're coming from, and that very much _was_ the way things used to work. The new law changes that. It governs interactions with EU citizens regardless of where they are.