VCDPA data privacy risk