Provenance-enabled stewardship of human data in the GDPR era