  This paper considers the private release of statistics of several disjoint
subsets of a datasets. In particular, we consider the $\epsilon$-user-level
differentially private release of sample means and variances of sample values
in disjoint subsets of a dataset, in a potentially sequential manner.
Traditional analysis of the privacy loss under user-level privacy due to the
composition of queries to the disjoint subsets necessitates a privacy loss
degradation by the total number of disjoint subsets. Our main contribution is
an iterative algorithm, based on suppressing user contributions, which seeks to
reduce the overall privacy loss degradation under a canonical Laplace
mechanism, while not increasing the worst estimation error among the subsets.
Important components of this analysis are our exact, analytical
characterizations of the sensitivities and the worst-case bias errors of
estimators of the sample mean and variance, which are obtained by clipping or
suppressing user contributions. We test the performance of our algorithm on
real-world and synthetic datasets and demonstrate improvements in the privacy
loss degradation factor, for fixed estimation error. We also show improvements
in the worst-case error across subsets, via a natural optimization procedure,
for fixed numbers of users contributing to each subset.
