20 Questions Directors Should Ask About Privacy