privacy flaw