European Data Protection Board publishes new directive on GDPR