Commerce Department's Online Privacy Report a Positive Step, But Self-Regulation Isn't Enough