Preparing for GDPR: Are identity management and authentication core to GDPR?