  A user's data is represented by a finite-valued random variable. Given a
function of the data, a querier is required to recover, with at least a
prescribed probability, the value of the function based on a query response
provided by the user. The user devises the query response, subject to the
recoverability requirement, so as to maximize privacy of the data from the
querier. Privacy is measured by the probability of error incurred by the
querier in estimating the data from the query response. We analyze single and
multiple independent query responses, with each response satisfying the
recoverability requirement, that provide maximum privacy to the user. In the
former setting, we also consider privacy for a predicate of the user's data.
Achievability schemes with explicit randomization mechanisms for query
responses are given and their privacy compared with converse upper bounds.
