“Despite being in effect for over seven years, the GDPR regulation has not been sufficiently clarified through court cases and remains too high-level to serve as a clear implementation guide for engineers.”