We put more and more information about ourselves online, and in Europe remain confident that strong data protection laws apply. But whose law, exactly, does control the use of information about us? And how is that question decided?