Privacy regulation theory