Controlling privacy in recommender systems