How gdpr can be your halloween fright