Do privacy and data protection rules apply to legal persons and should they? A proposal for a two-tiered system