Towards a legal framework for a diffusion policy for data held by the public sector