There's no greedy mega corp that controls steem.

But there is Steemit, Inc. The Steem protocol and blockchain are mostly in their control. It is entirely possible for governments to take action against Steemit, Inc.

Of course, another organization or a set of (more) decentralized actors could revive/ fork the protocol and blockchain if Steemit, Inc became a pawn.

I agree, though, no one would bother Steemit with GDPR right now. However, if Steemit gets way more prominent and there are abuses, Steemit, Inc is possibly vulnerable.