Information and Privacy: In Search of a Data-Driven Policy