Data protection gone mad?