Redrawing the Boundaries on Purchasing Data from Privacy-sensitive Individuals