Could GDPR have stopped the Cambridge Analytica scandal?