Data privacy investigation