comprehensive data privacy legislation