A GDPR for artificial intelligence?