“There was so much expectation and excitement when we got GDPR passed in Europe. Now the law has been applied for almost five years, and nothing is substantially different” - human rights activist says.