Informing the Design and Refinement of Privacy and Security Controls