New EU data protection rules double down on companies, but governments can pry all they want