What is true of both the General Data Protection Regulation (GDPR) and the Council of Europe Convention 108?