Data protection in the EU: the certainty of uncertainty