The GDPR at Two — Global Floor or Global Ceiling?