GPDR has a clause that requires companies that uses data from the EU to explain exactly how they used the data and how the algorithm reach the conclusion it did. Deep Learning is currently a black box where you train it and it knows what to do, but we can't explain exactly how it did it.

https://www.kdnuggets.com/2018/03/gdpr-machine-learning-ille...

edit:typo