suppressing marginal cells to protect sensitive information in a two-dimensional statistical table ( fm malvestuto , m moscarini , m rafanelli proceedings of the tenth acm sigact-sigmod-sigart symposium & hellip ; ,