user sovereignty versus corporate disclosure mandates