Three years since GDPR, there’s much to learn from what’s happened since. We can also predict what’s next in privacy regulation.