privacy legal risk map