How to turn the new Privacy Act into fresh revenue