Governing identity privacy and security