PITA: Privacy Through Provenance Abstraction