So... the day all this GDPR stuff went into effect, I get an email from my institution about a privacy compliance breach regarding the storage of information outside of Canada. What timing to add to my already exploding inbox of privacy policy notices.