What are some specific requirements of the privacy program under the proposed order?
The privacy program must include risk identification, reasonable privacy controls, and monitoring for effectiveness.