The EU's General Data Protection Regulation (GDPR) showed great promise during development, but after one year in effect, considerable blind spots are coming to the fore.