In scrutinising Google’s and Facebook’s use of people’s data, European authorities need to enter new legal ground