draft data protection law