Two years of the GDPR: A cross-border data protection enforcement case from a consumer perspective