GDPR vs. Statistics?