The act really sets out to control the computer users who have information on all of us, or on individuals generally, and their servants or agents, their employees and so on, it doesn't set out to control these third parties.