privacy and principle of least authority