Some common approaches are:
only allowing aggregate queries (SUM, COUNT, AVG, STDEV, etc.)
rather than returning exact values for sensitive data like income, only return which partition it belongs to (e.g. 35k-40k)
return imprecise counts (e.g. rather than 141 records met query, only indicate 130-150 records met it.)
don't allow overly selective WHERE clauses
audit all users queries, so users using system incorrectly can be investigated
use intelligent agents to detect automatically inappropriate system use