Data protection: foreign firms