I've run into this issue a couple of times in my career. I'll see if I can explain with an example (please ignore the fact that this is implausible in the real-world).
Suppose I sell computers, and I have account data on the person that purchased every computer I sell. I also install tracking software on every computer I sell, so that it sends me detailed information about which websites are being visited on that computer.
I would like to set up some sort of system that would allow me to merge account data with usage data in aggregate, but NOT for individual users.
In other words, I don't want to be able to know that John Doe watches cat videos and surfs porn 7 hours a day. I would think that's a violation of his privacy. However, I do want to be able to know that men are 20% more likely than women to visit news sites. This would still require the merging of account data and usage data - I just don't want to be able to see merge results for individual users, only aggregates.
Is there any way to accomplish this? Simply encrypting the key that links the account and usage data is not enough, obviously. The join could still happen. It seems like you need to encrypt usage data in such a way that it can only be decrypted when more than 1 value is aggregated. Is such a thing possible?