Here's what the National Privacy Commission has to say about it.