Catching up with the Data Privacy Act