Provably Private Data Anonymization: Or, k-Anonymity Meets Differential Privacy
protecting respondents ' identities in microdata release .