Earlier quoted context omitted.
By suitably modifying queries to make them "differentially private" (technical term), one can allow queries on the data set which have an arbitrarily low probability of releasing personal information. http://research.microsoft.com/pubs/74339/dwork_tamc.pdf Building a database which can be locked down to differentially private primitives (differential privacy composes) would allow researchers to partially unlock this…
We do something similar. We precompute/aggregate exhaustively by following certain aggregation strategies. The aggregated statistics are further processed to ensure privacy. Differential Privacy cannot be directly applied since the underlying assumptions are too strong. An important consideration is that the error/noise added is independent of the answer. Which means that the system becomes unusable for almost all qu…
I.e., if you don't have differential privacy, then by definition there is a de-anonymizing query and you can get PII out.
Privacy of hospitals/providers is a separate issue, and yeah, it's pretty clear that differential privacy doesn't work for them. Thanks for the links, I'll check them out.
Edit: after reading your second article, it's deeply misleading. They assume that to compute a mean, one must compute 2 queries - sum(x) and len(x), each of which must be differentially private. But that's totally wrong! You can in fact run the query mean(x) + noise, and this last query itself can be differentially private.
The article also notes that queries on small data sets require more noise to be differentially private, which is totally true, and obvious.
This also, however, ignores the fact that most statistical inference drawn from such queries will be nonsense even without differential privacy. See, e.g., this article for an example of why: https://www.chrisstucchio.com/blog/2015/ab_testing_segments_...
This is a very bad critique of differential privacy.