entities that owe duties of care, confidentiality, and loyalty to the individuals whose data they hold, analogous to the duties that doctors, lawyers, and financial advisors owe to their clients.