GDPR: obligation, respecting citizen’s rights or a competition factor?