“operationalise 'sensible person' [know how to handle sensitive data] into rules about who gets what and for what purpose.” --@bengoldacre