Is the Good_or_Bad database GDPR compliant? Are the assessment criteria rigorous, and fuzzy enough, so the Bad list is at a minimum? Can we see the Data Protection Impact Assessment?