The Limits of Industry-Specific Privacy Law