violating personal data protection law