Originally Posted by
Cassidin
I would say they probably are...... until pursued by virtue of international treaties. There is probably a difference to "Legally immune" and "virtually immune". Pursuing takes time and money - and I would suspect is less likely to be actioned unless there is a formal complaint. Depends if they want to "assume" immunity and risk a large fine or not. It's probably about risk vs benefits. They may decided that the risk is small enough to carry on as they are.
I should add though: I am not a lawyer so this is all my own reasoning. I am involved at preparing for GDPR where I work however so have been spending a far amount of time reading up on the subject.