Privacy under CRS?