This is already the case. The EU gets to do this the same way that the US can use secondary sanctions to enforce its will on Iran despite the EU notionally sti

This is already the case. The EU gets to do this the same way that the US can use secondary sanctions to enforce its will on Iran despite the EU notionally still being in the JCPOA. There've been noises about protecting European companies doing business in Iran from US sanctions - note that they have been coming from people on the margins, this isn't going to happen. That kind of power is just the privilege of being a large, wealthy trading block and it's basically the reason the EU exists. What would happen if The Netherlands or Poland tried to individually enforce a regulation as onerous as the GDPR on all companies holding data on their citizens? Nothing. Either companies would just withdraw from those markets or they would rely on the impossibility of enforcement. The EU is a sovereignty compromise that gives up some local de jure sovereignty for greater EU-wide de facto sovereignty.