Consumer exercising GDPR right to erasure