Privacy laws and social engineering