AG says Data Protection Act will need constant review