Yes, it's part of the GDPR (which really seems one of the most well-intentioned pieces of legislation once you read through it).