I went to Dwork's talk about differential privacy at the Berkeley School of Information last week. It was a very good presentation.

The motivation was that we don't know how to anonymize real data sets (particularly in the presence of potentially unanticipated auxiliary information, such as a related database that we didn't realize exist, or related statements by people about themselves or about populations) so that they can't be deanonymized. For example, taking people's names, addresses, etc., out of a database isn't good enough because the database still reflects their demographic or biographical history, and there may be only one person in a particular context who has that history, or you may just be able to match up the records in the database with records in a different non-anonymized database or one that contains other fields.

Therefore, Dwork defines a probabilistic notion of privacy loss which describes a bound on the probability that an adversary can learn about the people in the database (I think described in the basic case by the probability that an individual's presence or absence in the database is distinguishable to the adversary, although that's not a precise translation of the rule).

The actual implementations of this idea generally involve adding noise to the database, for example deliberately introducing noise in the sampling or survey process that created the original database, or by having a trusted party that controls the database that adds noise in response to particular queries by untrusted users. Then it's possible to make probabilistic arguments about how much noise of what kind is sufficient to satisfy the probability bound.

As a result, people can do analysis of the datasets to find population statistics that are of interest to them, but with a low probability of being able to learn things about individuals in the database deliberately or accidentally.

An interesting example of a mechanism that Dwork gave that was proven to satisfy one kind of differential privacy bound (although it was invented much earlier) was a technique used by researchers who were studying sexual behavior. They gave people a spinner and asked them to use it (privately) and answer the question truthfully if the spinner came up one way, and just to say "yes" if it came up the other way.

https://en.wikipedia.org/wiki/Randomized_response

That gave people a certain level of deniability (you could actually choose the level by the design of the spinner) and so their incentive to worry about being personally associated with their answers was lower. As a result, researchers concluded that survey participants would be more willing to give honest answers to embarrassing questions (when the spinner told them to). But the resulting answers did have a clearly-understandable relationship to the truth so you could calculate some population statistics accurately (mostly about the true prevalence of "yes" answers in the population). Dwork explained that this can meet the differential privacy bound, although most of her own research has been on adding noise at query time rather than at collection time.

In that case, you get a "privacy budget" which gets "spent" as researchers query the database and examine it in various ways.