Unpicking the privacy paradox