Discussion Document — Beyond Consent: A New Paradigm for Data Protection