The promise and limitations of formal privacy | Synapse