Extra-territorial enforcement is a different matter, though. A government on the far side of the world can say whatever it likes in its own laws, but if a busin

Extra-territorial enforcement is a different matter, though. A government on the far side of the world can say whatever it likes in its own laws, but if a business has no presence there, why would that business be under the foreign government's jurisdiction? The EU's strategy with the GDPR, in attempting to make it viral so that businesses it could reach within its own jurisdiction could be penalised if they dealt with businesses it couldn't reach elsewhere, is a dangerous path to be following. Taken to its logical conclusion, this kind of strategy becomes a significant barrier to international trade and can leave businesses in impossible positions. A better way to address these issues is for governments to make proper international agreements with each other on matters where they agree on the principles, so that businesses in any state that is party to those agreements know what the rules are, and the rules are consistent and enforceable throughout the states making the agreement. Without such agreements, one would hope that governments of states that have not implemented some rule would protect their own businesses, including actively intervening to support those businesses if they were being "leaned on" to enforce the rules of other states extra-territorially. We really don't want a world where any sufficiently large political power -- the US, EU, China, India, whoever -- can unilaterally set rules that apply to everyone else as well.