A regulator’s radical defense of privacy