Privacy and Access Control for Outsourced Personal Records