Ensuring Privacy in Domain Objects