Privacy engineering recommendations