Are we being overcautious regarding the Data Protection Act?