Regulated privacy, or privacy in name only?