An approach that I think is worth exploring is ad-hoc aggregation: variable selection with summary bucketing (aggregate results have a error bound) so that individual samples cannot be isolated.
That's what FreshBooks does with their report cards. They also throw in a very small amount of jitter to make sure math savvy people can't back calculate the number of people in a geographic location.
