It is a mistake I keep seeing, even in organizations that think they have a mature third-party risk program. They treat privacy as just another category of security.