GDPR is written in terms of rights people in the EU have against companies operating in the EU. Which is to say your hypothetical dual citizen would have zero

GDPR is written in terms of rights people in the EU have against companies operating in the EU. Which is to say your hypothetical dual citizen would have zero rights under GDPR in their dealings with purely US entities.