A computer system comprising a client computer and a database stored on a server, the server being coupled to the client computer via a network (48; 114), wherein the database comprises a first relation and a second relation (32; 34), wherein the first relation comprises first data items, wherein the first data items are encrypted with a first cryptographic key (18; 108) in the first relation, wherein the second relation (32; 34) comprises equivalence classes, wherein the equivalence classes are encrypted with a second cryptographic key (18; 108) in the second relation (32; 34), the first and the second cryptographic key being identical, the second cryptographic key (18; 108) being associated with a first key identifier which uniquely identifies the second cryptographic key (18; 108), wherein each equivalence class is a functional value of one of the first data items, the functional value being obtainable by applying an equivalence relation to the one of the first data items, wherein the second relation (32; 34) comprises for each equivalence class an allowed first key identifier and a referential connection assigning the equivalence class to the first data item stored encrypted in the first relation whose equivalence class is the functional value of said first data item, wherein the client computer has installed thereon an application program, the application program being operational to perform the steps of: - receiving a search criterion, - applying the equivalence relation to the search criterion for obtaining a search equivalence class, - encrypting the search equivalence class with the second cryptographic key (18; 108), - generating a database query using the encrypted search equivalence class and an included first key identifier, - entering the database query into the database stored on the server, - in response to the query, receiving an encrypted first data item matching the equivalence relation of the search criterion, - decrypting the received encrypted first data item using the first cryptographic key (18; 108), wherein the database is operational to perform the steps of: - receiving the database query, - applying the query to the second relation (32; 34) for obtaining a matching equivalence class, - determining in the first relation the encrypted first data item assigned to the matching equivalence class using the referential connection of the matching equivalence class, wherein the determining in first relation of the encrypted first data item assigned to the matching equivalence class is only performed in case the included first key identifier matches the allowed first key identifier for the matching equivalence class, - providing the determined encrypted first data item to the client computer. - receiving a search criterion, - applying the equivalence relation to the search criterion for obtaining a search equivalence class, - encrypting the search equivalence class with the second cryptographic key (18; 108), - generating a database query using the encrypted search equivalence class and an included first key identifier, - entering the database query into the database stored on the server, - in response to the query, receiving an encrypted first data item matching the equivalence relation of the search criterion, - decrypting the received encrypted first data item using the first cryptographic key (18; 108), - receiving the database query, - applying the query to the second relation (32; 34) for obtaining a matching equivalence class, - determining in the first relation the encrypted first data item assigned to the matching equivalence class using the referential connection of the matching equivalence class, wherein the determining in first relation of the encrypted first data item assigned to the matching equivalence class is only performed in case the included first key identifier matches the allowed first key identifier for the matching equivalence class, - providing the determined encrypted first data item to the client computer.