And that is why the burden of proof will soon be on the company, not the user, cf the data protection regulation