whose responsibility is data protection