Data agency broke privacy laws