GDPR: A Game of Snakes and Ladders