New privacy agency cannot expand unchecked in the dark