  Controlled query evaluation (CQE) is an approach to guarantee data privacy
for database and knowledge base systems. CQE-systems feature a censor function
that may distort the answer to a query in order to hide sensitive information.
We introduce a high-level formalization of controlled query evaluation and
define several desirable properties of CQE-systems. Finally we establish two
no-go theorems, which show that certain combinations of these properties cannot
be obtained.
