The EU prepares ground for wider data retention – and VPN providers are among the targets