Differential Privacy for Databases