GDPR is the EU's new data protection law and it's meant to give users control over their data. But is it enough?