Why a proposed 6-month data expiry rule could be a bad idea