It doesn't matter really; so far my entire experience with GDPR is that people just claim they think you're not in the EU and tell you they won't remove any of your data (AirBNB did this for friends who tried to get their data deleted, and I've seen similar things from a number of companies who want proof that you're an EU resident, but I'm obviously not sending them even more info like a passport just to convince them to delete my data). I wish the GDPR had any teeth, but companies for now seem to think it doesn't.

I does have teeth, but you need to be willing to sue the company to force removal. Data protection agencies are swamped with complaints so you have to take things into your own hands. Article 79 opens up for civil action against data controllers that refuse to obey the GDPR. Data subjects can sue for compensation, but are probably not restricted to compensation. It's a reasonable interpretation of the GPDR that you can sue for deletion.

At the very least your friend should submit a complaint to his country's data protection agency.

In your case I absolutely think that you could have a valid claim for compensation. But the devil is in the detail. For example, on what legal basis is the company you interviewed with processing your data? On what basis is Pana processing it? If you're genuinely interested in trying to claim compensation you can reach out to me and I can give you some directions and reading tips.

EDIT: IANAL, but I work with data protection questions.