Algorithmic Decision-Making and Data Protection in the Framework of the GDPR and Beyond