2017-300-059, Privacy Program Directive