privacy models and measurement