  Sequential querying of differentially private mechanisms degrades the overall
privacy level. In this paper, we answer the fundamental question of
characterizing the level of overall privacy degradation as a function of the
number of queries and the privacy levels maintained by each privatization
mechanism. Our solution is complete: we prove an upper bound on the overall
privacy level and construct a sequence of privatization mechanisms that
achieves this bound. The key innovation is the introduction of an operational
interpretation of differential privacy (involving hypothesis testing) and the
use of new data processing inequalities. Our result improves over the
state-of-the-art, and has immediate applications in several problems studied in
the literature including differentially private multi-party computation.
