Who is entitled to assert the GDPR's data subject rights? Against whom? An overview of the territorial scope of the GDPR.