LINDDUN PRIVACY MODEL