GDPR and the Retail Sector