vulnerable user legislation