Proposing a framework for data protection legislation