Privacy assessment and decisions