Why Was a Tiny Analytics Company Hit With Europe's First GDPR Enforcement Action?