Is it time for a bill of data rights?