EU data protection rules: the right mix