I support reigning in the NSA, GDPR seems like a weird way to do it. I don't follow the logic.
An EU company can just be hacked legally.