Only the third year of GDPR, but a legacy in the making