Analysis: In privacy legislation, a private right of action is not an all-or-nothing proposition (Brookings Institution)