10 principles for CAV data protection