The European Union’s independent data protection authority has released its 2018 annual report, which indicates that companies are still struggling to adapt to the General Data Protection Regulation, which took effect last May.

“So far, rather than adapting their way of working to better protect the interests of those who use their services, companies seem to be treating the GDPR more as a legal puzzle, in order to preserve their own way of doing things,” European Data Protection Supervisor Giovanni Buttarelli wrote in the report.