More and more applications rely heavily on large amounts of data in the distributed storages collected over time or produced by large scale scientific experiments or simulations. An important fact is that many organizations collect, store, and use various types of information about individuals. In consequence, such data sharing is subject to constraints imposed by privacy of individuals or data subjects as well as data confidentiality of institutions or data providers. Given a query spanning multiple databases, it should be executed transparently and efficiently. And most importantly, the results should not contain individually identifiable information and institutions should not reveal their databases to each other apart from the query results. In this paper, we propose a distributed anonymization protocol that allows independent data providers to build a virtual anonymized database from horizontally partitioned databases, and a secure query protocol that allows clients to query thos...