Sensitive data and the US Patriot Act