shared service agreement privacy rule