data havens and operator protection