legislation regarding data protection and security in uk