Automating privacy decisions -- where to draw the line?