Why data retention legislation would do more harm than good