Private firms can't sue you for GDPR violations but they can encourage customers to file requests that are expensive to deal with. It's not just over-broad erasure requests, it's the right to get a data dump of everything the company knows about you (this is like the worst case for big firms that don't have joined up IT systems).

I doubt private firms actually will engage in that sort of trolling though, at least not at any volume. NGOs and activists on the other hand, I fully expect that. They're always looking for ways to punish firms who they dislike. Normally that's restricted to boycotts, in recent times they've experimented with attacking advertisers for companies that rely on advertising ... GDPR requests will likely become a new battleground.