Effective Data Protection Requires More