Privacy risk assessments: Yay or nay?