Privacy risk models for designing privacy-sensitive ubiquitous computing systems