GDPR and the Law of Unintended Consequences