Inference Control in Statistical Databases