Formal Methods for Privacy