Inadvertent Data Collection in the Age of EU GDPR