Mark Zuckerberg goes before Congress. What happens when a private company violates privacy?