The GDPR has no teeth to enforce fines outside of its jurisdiction. Which is why it never has despite finding violations.