When trying to keep information confidential, an attacker can often infer some of the information by using statistics.
In situations where data should not be tied to individual users, but a large number of users should be able to make queries that "scrub" the identity of users, it may be possible to get information about a user -- e.g., by specifying search terms that are known to be unique to that user.
This is a complex topic. See the [REF-1492] for a good discussion of best practices.
Sensitive information may possibly be leaked through data queries accidentally.