What GDPR's first year says about data privacy regulation