A Formal Framework for Quantifying Voter-controlled Privacy