Study on the enforcement of GDPR obligations against entities established outside the EEA but falling under Article 3(2) GDPR