Privacy laws and penalties