On Guaranteeing k-Anonymity in Location Databases