Does the draft data protection bill dilute the power of the data authority?