data protection ruling