Complying with the GDPR when vulnerable people use smart devices