It definitely has not. Let's say company X allows company Y to access data that is personally identifiable. X is located in the EU, whereas company Y is not. Y

It definitely has not. Let's say company X allows company Y to access data that is personally identifiable. X is located in the EU, whereas company Y is not. Y promises to allow persons to delete their data upon request. However, there is no way that a person know their data has been shared from X to Y until they want to delete their data. At that point, who knows how far the data has spread or if it is even possible to track down. Y could have shared the data with any number of third parties, or may even be incapable of finding every reference to an individual and since it is not EU governed it will be difficult to ever bring Y to court.