How Differential Privacy Works