Does GDPR mandate a payout to the researcher after disclosure?