Differential privacy from axioms