Tangent differential privacy