Joint Communication and Sensing (JCAS) technology is envisioned to become a part of many Cyber-Physical Systems (CPSs), further advancing essential capabilities provided to numerous applications in critical infrastructure. Due to the use of human-specific sensing data, JCAS systems are vulnerable to privacy threats, and there is no established method to assess the privacy of such systems efficiently. In this paper, we propose a new privacy assessment approach that quantitatively expresses the overall privacy of the JCAS-based system under consideration, for which privacy enhancements are then proposed. While we apply our approach to a railway JCAS-based CPS in this paper, it also applies to CPSs of other kinds.