Blocking access to EU citizens while keeping their data in violation of GDPR sounds like a case for this maximum penalty. It doesn't seem the company is showing good faith in data protection.