Can American businesses actually be sued or anything over GDPR? What if all my servers are housed in america?
If I have a user agreement that my users agree to, I don't particularly care what another country thinks about what kinds of privacy they think my users are entitled to. I would already have a legal agreement in that case.
If it is against the GDPR, then it is an illegal agreement in the EU. Non-enforceable contracts are a thing. You are not allowed to literally sign away your firstborn, sell yourself into slavery, or accept a job at less than minimum wage.
Enforceability will generally be based on revenue streams coming from the EU (oh you want a credit card processed from an EU user? We'll be taking that money as a payment towards your fine.) If you're a particularly flagrant violator, they may arrest you if you ever dare set foot on European soil.
>>You are not allowed to literally sign away your firstborn, sell yourself into slavery, or accept a job at less than minimum wage.
The last item is nothing like the first two. The EU is now going to see the natural conclusion of a society based on its conception of contract rights. Digital technology magnifies the effect of everything by several orders of magnitude, so I suspect we'll see dramatic consequences flow from the law.
From a legal perspective, the last is pretty close to the first two. If you sign a contract saying those things a court will throw it out. End of story. This is how contracts work in the US too.
Same as how in California non-compete clauses are illegal.
a) There is no such thing as common law in non-UK Europe.
b) Common law was perfectly fine with slavery until it was outlawed by statute.
c) Even in the American system, common law is just one more source of law, alongside statute. Common law prohibits "unconscionable" contracts, but that doesn't mean statute law is prohibited from prohibiting other kinds of contracts (which it does all the time). Hence the boilerplate "void where prohibited" language in all kinds of contracts.
If I have a user agreement that my users agree to, I don't particularly care what another country thinks about what kinds of privacy they think my users are entitled to. I would already have a legal agreement in that case.