A System-Level Framework For Privacy