European Commission must withdraw new law to uphold online privacy, security and free expression