This is a much bigger deal than GDPR ever was.