Analysis: To enhance data security, federal privacy legislation is just a start (Brookings Institution)