Not just User Control in the General Data Protection Regulation · Study