An eye works for this purpose, and it explicitly refers to the potential agent(s) who might 'see' what data is not private (arguably the most important piece of the picture), rather than to the data itself.
- Internet Explorer used this for a long time, which means a huge potential audience is experienced with it.

A mask or other way of concealing the face also works (a disguise might do the same), in this case referring to the user (with his or her visibility standing in for his or her data's visibility).
- Firefox includes this in its privacy settings, which is similar (in that it includes eyes) but different (in that it portrays the user rather than the outside agent).

- Chrome uses or used a similar icon, involving masked identity, for their Incognito Mode (specifically for extra privacy).
(also see this version)
The common thread here, of course, is sight, and whether others can see their data.
Both of these choices would seem to be less encumbered by multiple meanings than a lock icon would be (e.g. conflict with "unchangeable" as @AgilePro mentioned).
(Another similar representation would be a ghost, such as for Ghostery, where translucence ~= invisibility ~= privacy, but that is also encumbered by other meanings.)
(more examples, with redundancy:)

(more with redundancy including the lock concept:)

(Note: I found some interesting icons very related to this while looking for the Firefox mask icon. https://wiki.mozilla.org/Privacy_Icons