EU Personal Data Protection in Policy and Practice