Two Years of GDPR