What is the key factor that lays the foundation for all other elements of a privacy program?