penalties and privacy notification