A British researcher has uncovered an ironic, gaping security hole in the EU’s General Data Protection Regulation (GDPR) - right of access requests.