The security of personal data under the GDPR: a harmonized duty or a shared responsibility? | Synapse