On provenance and privacy