As far as EU citizens vs. residents, that concept ought to be clear: an EU citizen doesn't have protection of EU laws when outside of the EU just as an American

As far as EU citizens vs. residents, that concept ought to be clear: an EU citizen doesn't have protection of EU laws when outside of the EU just as an American banking in France isn't protected by US banking laws. The passport of a complainant isn't relevant, but their physical location. Yes, that's a common point of confusion, but it's completely correct: the GDPR applies to people in the Union, not to EU citizens everywhere (for non-EU companies, that is - an EU company has to apply the same protections for every user in the world).