You can file a complaint with any EU supervisory authority, even if you’re not personally an EU citizen, as long as the company you’re complaining about does operate specifically and targeted in the EU. It is better if you are a citizen though. But as long as they’re mishandling EU citizens data, doesn’t matter who tells the authorities.