Earlier this year, the European Union’s General Data Protection Regulation (GDPR) went into effect, radically changing the way data can legally be collected