Privacy law rots from the head