Only if the US company chooses to provide goods and services to customers in the EU and collects their personal data.
The case in point is like a US web company only providing services to US customers, but some Europeans who VPN'd into the US web site and pretended to be Americans sued it under the GDPR anyway. In this case the proxy company holding the Toyota shares takes the role of the VPN.
The case in point is like a US web company only providing services to US customers, but some Europeans who VPN'd into the US web site and pretended to be Americans sued it under the GDPR anyway. In this case the proxy company holding the Toyota shares takes the role of the VPN.