Why we need to understand more than the Privacy Act