What is the significance of this decision? This is already explicitly stated as disallowed in GDPR. Is this just an declaration of intention to enforce the existing law?