What do you do when a government agency comes asking for access to personal data? EU GDPR / UK Data Protection 2018