Getting the GDPR right for HR