Lessons from GDPR for AI Policymaking