Online privacy protection is weak, says EU official