Rewriting European privacy law for digital age