Will Facebook's phased GDPR strategy be enough?