The targets will still need to spend time (and thus, indirectly, money) to demonstrate that such a letter is such an "undue burden".

This assumes they can even do so; if there are national regulators who hold the same opinions that some HN posters do about Google and Facebook, there may be no definition of "undue burden" they are willing to accept.

I'm honestly not sure. I doubt you could do this if you weren't a EU resident or citizen...