Yes, but it doesn't actually happen. It's basically impossible for an individual to enforce their GDPR rights.