Privacy　is　one　of　the　most　important　issues　in　providing　high-quality　ubiquitous　network　services　to　users　over　the　Internet.　Although　several　privacy　aware　access　control　models　have　been　proposed　in　recent　years,　these　models　still　rely　mostly　on　the　traditional　access　control　models　designed　primarily　for　security.　When　privacy　becomes　a　main　concern,　these　models　are　no　longer　adequate.　In　this　paper,　we　propose　a　three-dimensional　access　control　model　enhanced　with　privacy　and　show　that　our　model　can　be　used　as　a　general　method　for　defining　privacy　requirements　in　systems　that　respect　and　protect　user　privacy.　By　introducing　the　notions　of　privacy-concerning　subjects　and　privacy　access　rights　and　enhancing　the　traditional　two-dimensional　access　control　models　with　a　third　dimension,　we　demonstrate　that　our　privacy-enhanced　access　control　model　can　better　describe　and　support　user　requirements　for　protecting　private　information　when　access　control　is　used　for　making　access　decisions　to　user　information.