UK trade sector risks GDPR fines over poor data disposal