This article considers whether it is fortunate that data protection rules, as a starting point, apply to all physical persons as data subjects, or whether it would be better to differentiate between kinds of persons on grounds of their ability to act as a data subject. In order to protect all persons, it is argued that a principle of care should be part of data protection law.