Is this true? Doesn't the GDPR only applied to those within the EU (i.e., resident or not), or anyone, anywhere, if the company handling the data is in the EU?