Who can the EU fine? More broadly... what conditions must exist for a governmental body to enforce its laws on a foreign company? Concrete example: the European Union fined Google for what it found to be anticompetitive practices. What gives the EU power to enforce such a penalty on a US company? What if Google had no physical presence in Europe but did effectively serve and make money from Europe. I assume France could not successfully sue and enforce against John Doe Individual in the US for selling Nazi paraphernalia online on a site accessible by people in France. Where is the line?
The legal line is EU laws, with some considerations (at the time of enacting them) about what other countries and international organizations (like the WTO) reactions. The practical line is enforcement. As the country with the biggest stick (not only militarily but economically) the USA provides the best examples: the ongoing Huawei affair, with one tip executive arrested on the grounds of a Chinese company selling technology to NK. the Helms-Burton Act that punishes foreign companies trading with Cuba, and that asserts that USA courts can decide on issues of private property in Cuba. the Iran embargo. In the Google case, it is even simpler. If Google wants to do business in the EU, it must follow EU law like everyone else (same happens in the USA and elsewhere). The fact that parent company is registered in the USA is not relevant. And probably, the fine has been issued not to the parent company but to the subsidiary registered within the EU. In the John Doe CASE, France (not the EU) could try first to seize any of his assets in France and, if those are not enough, go to the USA courts and try to have them enforce its judgements. But if what John did was not illegal in the USA then the courts would probably refuse to do so. That does not mean that John is guaranteed to be immune to any consequences, as France could block international money transfers to John's accounts, force Amazon (or whoever) to make his shop unavailable in France, block his page, and even issue an international warrant that would mean that Jhon would have the risk of being arrested if he ever leaves the USA.
There is no possibility of legally holding a country &quot;to account&quot; for an action. An individual could be legally tried for a crime (murder), and a country could via a political process be made to suffer the consequences if a leader performs some act (it need not be illegal). Germany, Iran and Russia have historically suffered certain consequences of actions held to be &quot;officially sanctioned&quot;, and individuals such as Adolf Eichmann have been specifically punished; Fahad Shabib Albalawi and 4 others were sentanced to death for involvement in Khashoggi's murder. Punitive recourse against a country is always via political / military action. Khashoggi, specifically, was apparently a lawful permanent resident of the US, which is probably sufficient connection to the US for a suit based in the Alien Tort Statute. There have been various suits filed against individuals under this act, some of which succeeded, for example Filártiga v. Peña-Irala, 630 F.2d 876. An individual could be sued under the Alien Tort Statute, but a foreign government enjoys sovereign immunity (the US government has limited its liability on that grounds, but Saudi Arabia has not). His fiance might then sue some individual, but Saudi Arabia itself could not be &quot;held to account&quot;.
Why is a business allowed to refuse a customer? Because also freedom of contract is a right. Except for discrimination on the basis of protected categories, a person or entity is entitled to discretion on whether or with whom to do business and enter contracts. The last sentence in your post reflects a misconception of "completely different set of values and laws" between the USA and members of the EU. Clearly there are many differences, but a comparison of the Wikipedia link you posted and, for instance, 42 U.S.C. § 2000e-2 reflects an overlap of protected categories in the laws of the Netherlands and of the US, such as religion, sex, race, or national origin/nationality. One would need persuasive evidence to support a finding of unlawful discrimination in the two examples you have experienced. Assuming the bank responded to your GDPR inquiry truthfully, the bank's refusal to open an account might have stemmed from profiling or decision-making that (1) does not precisely require specific data about you, and/or (2) uses information the bank does not need to log for purposes of compliance with the GDPR. Note that the GDPR does not outlaw algorithmic decision-making. Since legislation in the EU (as in the US) portrays an approach of market economy, both bank and landlord are entitled to made decisions on the basis of their inner policies for risk management. The policies might be unclear to you, but that does not necessarily mean they contravene principles of equal opportunity.
Laws of the host country do apply in foreign embassies, but the authorities of the host country may only enforce laws in a foreign embassy by invitation of the foreign diplomatic delegation. So the general question would be whether the German embassy in London is bound by German law or by British law? It is subject to both, but the embassy can decide to what extent British law applies. In the case of a mask mandate imposed by British authorities, the embassy may require its occupants and visitors to comply with the conditions imposed under British law. It could also refrain from imposing such a requirement. In fact, unless German law prohibits a mask requirement, it can impose a mask requirement on its own initiative even if there is none imposed by British law nor German law. Is the German embassy London bound by the Equality Act 2010 and cabinet office guidance on medical mask wearing exemptions? It is not bound, but it may comply voluntarily.
The US has jurisdiction because the systems that the accused allegedly attacked are in the US. To use an example with older technology, you can't escape criminal liability for defrauding someone in one country simply because you did so through the mail or by telephone from another country. The UK and the US have an extradition treaty. The UK might refuse to extradite the accused; in that case the US would most likely complain loudly. If too many extradition requests are refused on one side, the other side might start limiting cooperation in any of several areas.
are there any GDPR considerations that must be in place when an EU company stores personal information from citizens outside of the EU? Absolutely. The territorial scope of the GDPR is specified at Article 3: Article 3 Territorial scope This Regulation applies to the processing of personal data in the context of the activities of an establishment of a controller or a processor in the Union, regardless of whether the processing takes place in the Union or not. This Regulation applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing activities are related to: (a) the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union; or (b) the monitoring of their behaviour as far as their behaviour takes place within the Union. This Regulation applies to the processing of personal data by a controller not established in the Union, but in a place where Member State law applies by virtue of public international law. As specified in point 1, the regulation applies to controllers and processors located in the EU. There is no exemption of personal data based on the data subject's nationality or location. In fact, GDPR Recitals 2 and 14 explicitly mention that nationality or residence shall not be a factor: The protection afforded by this Regulation should apply to natural persons, whatever their nationality or place of residence, in relation to the processing of their personal data. […]
Note that the answer to most of your questions has nothing to do with the GDPR specifically, but has to do with the legal force that an EU Regulation has. Here's a related answer on EU Regulations vs. Directives. That said, here are my answers to your specific questions: So member states can define a different age, even though the GDPR says that it should be 16. But is this an exception? Yes. Are there any other exceptions? Yes. Scanning the Regulation for instances of "Member State" is a good way to find them. In my opinion, the biggest area of the GDPR where Member States have influence is Article 6, "Lawfulness of Processing". In some circumstances, it allows Member States to specify what could be considered a lawful basis for processing. Must these exceptions be explicitly stated in the GDPR? Yes. As a Regulation, exceptions must be explicitly stated in order to be permissible because Member States have no authority to overrule EU law*. I'd like to understand to what extent the GDPR must be followed by member states, and to what extent it could be amended in national laws. "Amended" is a fuzzy term. It can mean adding, changing, or removing from the law. Unless otherwise specified, Member States could not change or remove provisions, but there could very well be additions consistent with the GDPR. *Some Member States dispute this statement when it comes to constitutional issues.
The main question is whether the US has jurisdiction outside the US, which means either "in another country" or "in no country" (viz. the high seas or outer space). It has generally been felt (legally) that the US has no jurisdiction over foreign countries, see especially Banana v. Fruit, 213 U.S. 347 "the general rule is that the character of an act as lawful or unlawful must be determined wholly by the law of the country where it is done". This is known as the "presumption against extraterritoriality": it is a presumption, not a rigid absolute rule. However, there are exceptions. The Alien Tort Statute (one of the first laws of the US) says "The district courts shall have original jurisdiction of any civil action by an alien for a tort only, committed in violation of the law of nations or a treaty of the United States". An application of that law is Filártiga v. Peña-Irala, where defendant tortured and murdered plaintiff's daughter, all parties being in Paraguay at the time: the court held that the US did have jurisdiction, under the ATS. Nevertheless, in Sosa v. Alvarez-Machain, 542 U.S. 692 which involves an extraterritorial kidnapping, SCOTUS seems to have said that this law is primarily about granting jurisdiction, and not about creating new torts, and they indicate that the wrongful acts within the scope of the ATS are, specifically, "offenses against ambassadors, violation of safe conducts, and piracy" (at any rate, it's clear that damage arising from pollution would not be within the class of bad acts referred to by ATS). Kiobel v. Royal Dutch Petroleum Co. reaffirms the limit on what torts can be pursued under ATS. In this case, the issue is whether RDP might be corporately liable for acts that could be illegal under US law, and the court says "[w]hen a statute gives no clear indication of an extraterritorial application, it has none" (citing Morrison v. National Australia Bank Ltd.). Accordingly, Taylor Jr. was held liable for his role in torture in Liberia, since the Torture Victim Protection Act does specifically allow for actions against individuals acting in their official capacity, outside the US, for torture and extrajudicial killing. "Sanctions against" is kind of open-ended. The US government can (under some circumstances) prevent US persons from doing things with respect to some other country, such as the restrictions against doing business with or visiting Cuba, Albania, North Korea etc. as have existed withing the past quarter century. Were I interested in sending money to a person in Iran vs. a person in Canada, I would have more problems in the former case owing to "sanctions". I think we can safely conclude that the US cannot (in terms of US law) declare that "whatever acts of a foreign entity overseas offend the federal government shall be litigated as though the acts were committed within the proper jurisdiction of the US" (or, more simply, "the proper jurisdiction of the US government is the universe"). Congress has not yet passed such a law about extraterritorial pollution, so until it does, it cannot sanction overseas polluters. When/if it does, it presumably can, though enforcement is another (political) matter.