Don't forget all types of data in Privacy Act compliance: lawyer