A method of aggregating data from a first client and a second client, the method comprising: • generating, by the first client, encrypted data c 1 by calculating: a.) c 1 ← Enc'(pk', m 1), b.) c 1 ← c 1 ⊗ (1, (1/pk 2)^sk 1), wherein Enc'(...) denotes the enciphering algorithm of the El Gamal encryption scheme or a variant thereof, pk' denotes a server encryption key of a server, m 1 denotes data of the first client to be encrypted, pk 2 denotes an El Gamal public encryption key of the second client, sk 1 denotes an El Gamal private decryption key of the first client corresponding to an El Gamal public encryption key pk 1 of the first client, ⊗ denotes an homomorphic combination operator of the El Gamal encryption scheme or a variant thereof and ^ denotes the exponentiation operator (step 201), wherein the first client has access to the server encryption key pk', the El Gamal public encryption key pk 2, and the El Gamal private decryption key sk 1, • generating, by the second client, encrypted data c2 by calculating: c.) c 2 ← Enc'(pk', m 2) d.) c 2 ← c 2 ⊗ (1, (pk 1 /1)^sk 2), wherein m2 denotes data of the second client to be encrypted, pk 1 denotes an El Gamal public encryption key of the first client, sk2 denotes an El Gamal private decryption key of the second client corresponding to an El Gamal public encryption key pk2 of the second client (step 203), wherein the second client has access to the server encryption key pk', the El Gamal public encryption key pk 1, and the El Gamal private decryption key sk2, • combining, by a homomorphic combination unit, the encrypted data c 1 from the first client with the encrypted data c2 from the second client by means of a homomorphic operation in the El Gamal encryption scheme according to: c 1,2 = c 1 ⊗ c 2, thereby arriving at an homomorphic combination c 1,2 resembling the aggregation of the data from the first client and the data from the second client (step 205), wherein the homomorphic combination c 1,2 is: c 1,2 = g ∧ r 1 ∗ r 2, pk ′ ∧ r 1 ∗ r 2 ∗ m 1 ∗ m 2, wherein g is a generator, and r 1 and r2 are integers, • decrypting, by the server, the homomorphic combination c 1,2 of the encrypted data c 1 from the first client and the encrypted data c2 from the second client on the basis of a server decryption key sk' (step 207), wherein the server has access to the server decryption key sk'. • generating, by the first client, encrypted data c 1 by calculating: a.) c 1 ← Enc'(pk', m 1), b.) c 1 ← c 1 ⊗ (1, (1/pk 2)^sk 1), wherein Enc'(...) denotes the enciphering algorithm of the El Gamal encryption scheme or a variant thereof, pk' denotes a server encryption key of a server, m 1 denotes data of the first client to be encrypted, pk 2 denotes an El Gamal public encryption key of the second client, sk 1 denotes an El Gamal private decryption key of the first client corresponding to an El Gamal public encryption key pk 1 of the first client, ⊗ denotes an homomorphic combination operator of the El Gamal encryption scheme or a variant thereof and ^ denotes the exponentiation operator (step 201), wherein the first client has access to the server encryption key pk', the El Gamal public encryption key pk 2, and the El Gamal private decryption key sk 1, a.) c 1 ← Enc'(pk', m 1), b.) c 1 ← c 1 ⊗ (1, (1/pk 2)^sk 1), • generating, by the second client, encrypted data c2 by calculating: c.) c 2 ← Enc'(pk', m 2) d.) c 2 ← c 2 ⊗ (1, (pk 1 /1)^sk 2), wherein m2 denotes data of the second client to be encrypted, pk 1 denotes an El Gamal public encryption key of the first client, sk2 denotes an El Gamal private decryption key of the second client corresponding to an El Gamal public encryption key pk2 of the second client (step 203), wherein the second client has access to the server encryption key pk', the El Gamal public encryption key pk 1, and the El Gamal private decryption key sk2, c.) c 2 ← Enc'(pk', m 2) d.) c 2 ← c 2 ⊗ (1, (pk 1 /1)^sk 2), • combining, by a homomorphic combination unit, the encrypted data c 1 from the first client with the encrypted data c2 from the second client by means of a homomorphic operation in the El Gamal encryption scheme according to: c 1,2 = c 1 ⊗ c 2, thereby arriving at an homomorphic combination c 1,2 resembling the aggregation of the data from the first client and the data from the second client (step 205), wherein the homomorphic combination c 1,2 is: c 1,2 = g ∧ r 1 ∗ r 2, pk ′ ∧ r 1 ∗ r 2 ∗ m 1 ∗ m 2, wherein g is a generator, and r 1 and r2 are integers, • decrypting, by the server, the homomorphic combination c 1,2 of the encrypted data c 1 from the first client and the encrypted data c2 from the second client on the basis of a server decryption key sk' (step 207), wherein the server has access to the server decryption key sk'.