Final HEROES data protection legal framework