data protection settlement