How the GDPR can be used to threaten investigative journalists