A Duty of Loyalty for Privacy Law