US rethink data protection policies