Where have you been? A Study of Privacy Risk for Point-of-Interest Recommendation