Why cut and paste will not work for national data protection legislation