Empirical evaluation of privacy regulation