Expected EU data breach rules draw fire before their release