GDPR Turns Two! Has Anything Really Changed?