4. Data protection and privacy