legal and privacy issues in information security