Regulations impose new obligations in handling personal information and preventing identity crimes