How to bring GDPR into the digital age