$1 million settlement. data privacy act