A Declarative Data Protection Approach: From Human-Readable Policies to Automatic Enforcement