Can we do anything at all with GDPR?