security and privacy risk