RSN AP STA's set the privacy subfield to 1 in beacons to require privacy in the BSS, and ignore the privacy subfield in association request frames (see the bold text above).
The opportunity to agree or disagree on the details of RSN cipher suites is based on the RSN information element.
I hope this helps. Thanks. /criss