Let's say you were given a dump from a security breach. You want to share the email addresses affected by the breach with a separate company who pays you for this service so that they can protect their users. Maybe it's a security company, or maybe it's a large retail store wanting to prevent accounts with shared passwords from being hacked.
The constraints are:
You cannot know anything about the company's users. They can't send you a list of email addresses that they want to subscribe to, because even if they are hashed you could discover the list and compromise the privacy of the company's customers. If you are dealing with a EU-based company, it's also against the law for them to share this if I understand correctly.
You don't want to send each company the entire list, only the list of emails that they subscribed to prior to the breach. You might initially be one of the only people given this dump- it's not publicly available- and you do not want the entire list to spread by an employee at one of these companies.
Is there a cryptographic means by which the company can declare to you ahead of time which addresses they are subscribing to, without you being able to decrypt this subscription and learn anything about their users, but by which you can construct a message to them when a breach happens such that they will learn only the addresses in the breach which were also in their prior subscription?
If they want to check the same breach against a larger set of emails (possibly for nefarious reasons), they would be forced to declare a new subscription. This new subscription should be useless to discover any new addresses based off previous communications based off the previous subscription. Then they request a new notification for the breach based on their new subscription. If their new subscription is not suddenly suspiciously large, you repeat the original process with the new subscription.
Bonus if it's possible for you to obfuscate the actual size of the breach when performing the sharing.
This seems like it's perfect problem for cryptography to solve. What are the possibilities at our disposal?