The European Commission may not be in compliance with the GDPR