In comparing GDPR and CCPA, lessons in compliance emerge