Formalizing and Enforcing Purpose Restrictions