How not to be GDPR compliant