Buying Private Data at Auction : The Sensitive Surveyor ’ s Problem