Reasoning about the Appropriate Use of Private Data through Computational Workflows