Models for Privacy Engineering