Actually you can use it to take down personal information, sort of like DMCA is used for copyrighted content.

Pretty much any website threatened with GDPR will remove your photos/phone number/email/whatever, they're not worth the fine. You could then still report them tbh (it has to be reported to whatever enforcement agency in the country it's hosted in, though, which only exist in the EU and are a pain to deal with).