Personality Merchandising and the GDPR: An Insoluble Conflict?