If this is correct, and it looks to me like it probably is, my interpretation is that the only time the trigger is activated is if the network has first been set to public and then the setting is changed to private.
I have all my systems set to private as the default setting, so in the normal course of events I would never be *changing* it to private. Wouldn't this mean the event would never be triggered? Instead of PROFILE_CHANGED_TO_PRIVATE, I would think PROFILE_IS_SET_TO_PRIVATE is what might be needed here.