There’s a difference from being able to protect privacy, and doing so in a way that complies with EU law