Law Governing Information Security and Privacy