Data protection reform: a softening of approach?