Data controllers will be held liable for any harm caused to the data subject as ... review algorithms that process personal data and see if they are being processed in privacy neutral manner.