Elements of Effective Self-Regulation for Protection of Privacy - Discussion Draft