GDPR – Two years After An empirical and analytical impact evaluation