Employee data protection under the GDPR and the new BDSG