How the General Data Protection Regulation changes the rules for scientific research