A Proof of differential privacy