In this paper we study the problem of providing controlled access to confidential data stored in semistructured databases. More specifically, we focus on privacy violations via data inferences that occur when domain knowledge is combined with nonprivate data. We propose a formal model, called Privacy Information Flow Model, to represent the information flow and the privacy requirements. These p...