Sure they can – if any subsidiary of the controller or processor is domiciled in the EU, they can penalize the subsidiary.