ex Art. 37-39 GDPR