I'll admit to what feels like a pedantic point: Yes, the EU can make a law saying it'll be very very angry if a non-EU entity does not do what it wants. But since this post is asking about HN's compliance with the GDPR, it seems practical to scope the conversation to "Can the EU make and enforce a law that affects non-EU entities".
Otherwise, it's fair to say that I can personally draft a document saying HN must give me $3.50, and sign it into law for the House Of Akerl. But my law is quite uninteresting to HN, given the low odds of any of the YC folks sending me $3.50.
Well, it seems we agree that the EU can make a law theoretically-legally affecting non-EU entities.
Can that law be enforced? That depends on whether YC has a representation in the EU, or people from YC plan to visit the EU in the future, or many other things. Maybe the EU gets creative to find other ways of enforceability. I don't intend to give a full assessment of the ways of enforcement.
Either way, it is not a nice thing to have a big jurisdiction going after you.
One can avoid the GDPR by not handling data from or about European citizens or people in the EU, and having no presence there, and actively filtering out affected people.
Otherwise, it's fair to say that I can personally draft a document saying HN must give me $3.50, and sign it into law for the House Of Akerl. But my law is quite uninteresting to HN, given the low odds of any of the YC folks sending me $3.50.