New EU data protection rules show how not to build trust online