A Model for Preserving Privacy in Recommendation Systems