GDPR working, but not well enough: EU report