Don’t Gamble with the GDPR