Promise not fulfilled: FinTech, data privacy, and the GDPR