Is the GDPR fit for purpose for the effective regulation of the use of personal data by increasingly complex and autonomous AI systems?