Privacy violations and penalties