Data protection legislation: interpretation and barriers to research