Is Research Exempt from Data Protection?