Lenders brace for privacy laws