This is an old post written long before GDPR. I really need to do an update…
30th June 2019: I have at last written an updated version of this post.