GDPR Position Paper