> There’s also the fact that GDPR is a directive. Each state (nation) has to implement it in their own laws. So the EU itself can’t enforce it, only the member states.

It's not. It's a "Regulation", a similar kind of legal act to a Directive, but comes into effect all on their own, across the whole of the EU. https://en.wikipedia.org/wiki/Regulation_(European_Union)