GDPR doesn’t just apply to citizens of EU countries, it also applies to residents and potentially people just passing through (e.g. changing flights at an EU hub).