Ten years later, has the GDPR fulfilled its purpose?