Profiling and (automated) decision-making under the GDPR: A two-step approach · Study