or 'data protection', which amounts to the same thing (no protection = no privacy).

There are a number of ways to handle this. The page in the link below (instructions to authors in Oxford journals) is relevant here.
The *generic subject*, internationally, is 'data privacy'.
And as it happens, the instructions give a quite literal *full* translation of the title of the French data privacy act:
"Loi n° 78-17 du 6 janvier 1978 relative à l'informatique, aux fichiers et aux libertés (French Act N. 78-17 of 6 January 1978 on Data Processing, Data Files and Individual Liberties)"

Up to you to decide whether a full citation is needed or whether a short-form descriptor is sufficient. I'd go for the short form.