The much maligned GDPR gives stronger privacy rights than anything the US has