violations of privacy and data protection obligations