How is social media commentary willingly handed over for public exposure a form of personal data? If GDPR is allowed to have such wide applicability there's going to be a lot of shakedown scams from bad actors.
> there's going to be a lot of shakedown scams from bad actors.
I'm not sure how that would work.
Any compliant service is likely to allow self-service (eg: a button to delete a comment; a link to list out all data; an edit function to correct wrong data).
If you're storing personal information and don't comply with the law, you risk a fine. Just as you risk a fine for mismanaging health data, or risk prosecution for storing data that is illegal, like child pornography.
You might also want to look at GDPR chapter 3, article 12, point(?) 5:
"Information provided under Articles 13 and 14 and any communication and any actions taken under Articles 15 to 22 and 34 shall be provided free of charge. Where requests from a data subject are manifestly unfounded or excessive, in particular because of their repetitive character, the controller may either:
charge a reasonable fee taking into account the administrative costs of providing the information or communication or taking the action requested; or
refuse to act on the request.
The controller shall bear the burden of demonstrating the manifestly unfounded or excessive character of the request."
Basically, for any data you give a company, you have to be able to later on have them remove it, or at least remove the association with you. For stuff like personal messages or posts, just anonymizing won't even be enough to comply.
This is grossly oversimplified to the point of almost being wrong, but is the general idea of what applies here.
Not really. For example, if the company has assets within EU jurisdiction, those can be seized to pay the fine, or if the company has assets outside of the EU, but with EU companies (e.g. banks), they can be forced to help seizing the assets.
There is countless precedent of the US using these tactics to enforce IP law, and EU countries using them to enforce consumer laws.
It is expected that the EU would do exactly this.
For example, if YCombinator refuses to adhere to the law, but holds shares in an EU startup (and they do in several), then those shares could be seized and auctioned off to enforce the law.