Capacity Bounded Differential Privacy