Privacy preservation of aggregates in hidden databases: why and how?