Minimisation of incidental findings, and residual risks for security compliance : the SPIRIT project