A User's Guide to Data Protection: Law and Policy