Data protection rules must be principled, permissive and pragmatic