GDPR is for data in the EU. That is it. Not data outside the EU and not people outside the EU. An American in the EU is covered, an EU citizen in the US is not.
What you are saying would require that the EU could create laws that were above the Supreme Court in the US for example. It simply isn't true.
Or people who wish to extend the reach of GDPR so that others outside of the EU are protected too.
> What you are saying would require that the EU could create laws that were above the Supreme Court in the US for example
This is not true for multiple reasons. Check out https://en.wikipedia.org/wiki/PROTECT_Act_of_2003 specifically "Authorizes fines and/or imprisonment for up to 30 years for U.S. citizens or residents who engage in illicit sexual conduct abroad". The EU could punish US companies that have offices in the EU or income from the EU. Alternatively it could sanction them.
https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELE...
That being said it wouldn't require the EU to create laws which have jurisdiction above the US supreme court - if a company has any activity within Europe the European courts can act. There are other examples - for example UK libel law allows people under certain circumstances to sue for libel in the UK even if both parties are not UK citizens and the libel itself occurred outside the UK. Another example is the US CFTC which claims jurisdiction over all swaps transactions even if both parties are non-US and the swap itself happened outside the US.
