Data protection and the law