Privacy vs. compliance