Interesting way of spelling "illegal misuse of personal information under GDPR".
It's probably also illegal to own a business at all in North Korea, but that law also doesn't apply to either person in this situation.
I'm under the impression that GDPR Article 3 (2) does apply in the case at hand, which is marketing emails sent by a US company to an EU resident.
It's probably also illegal to own a business at all in North Korea, but that law also doesn't apply to either person in this situation.