Which of the following is not a feature of the general data protection regulation (gdpr)?