GDPR Turns Two: What We've Learned So Far