GDPR is decent, but the governments themselves are pushing surveillance so it is two steps forward and one back.