New Directions in Anonymization: Permutation Paradigm, Verifiability and Transparency