Privacy Law: Positive Theory and Normative Practice