Modelling and Transforming Security Constraints in Privacy-Aware Business Processes