> what limits do we place on countries randomly being able to make supranational claims like this?

Randomly? EU or other nations act because their citizens have their rights violated. I assume Clearview has collected Dutch faces en masse and thereby violated laws.

Obey by GDPR or don't deal with the data of EU citizens.