How to integrate legal requirements into a requirements engineering methodology for the development of security and privacy patterns