addressing legal risks in data analysis