I haven't read the full text of the GDPR, but how exactly would the EU enforce fines like this against a company that ignores the GDPR but provides a virtual service within their border? E.g. a social media web service that has no physical assets in the EU. They could fine them all day long, but would have no power to enforce, right? Blocking IPs is a cat/mouse game.