data protection act commercially sensitive information