How German data protection law differs from the GDPR