A method of providing anonymized data, comprising the steps of, at a first server of a plurality of servers (303, 401, 402, 403) connected to a first data source (302, 404, 405, 406): receiving, from a networked location, a first message comprising a first encrypted identifier that said first server is unable to decrypt; generating, from said first data source, a first dataset that may include data corresponding to said first encrypted identifier; and returning said first dataset to said networked location; characterised in that: said first encrypted identifier includes a non-interactive zero-knowledge proof, generated from an identifier stored on a second data source (302, 404, 405, 406) not connected to said first server; said method further comprising the step of generating a shared encryption key at the first server, wherein the shared encryption key is known to each of the plurality of servers but not to the networked location; and said step of generating said first dataset further comprising the steps of: obtaining, from said first data source, a set of at least one local unencrypted identifier; and for each local unencrypted identifier in said set: using said shared encryption key, verifying said first encrypted identifier against said local unencrypted identifier, by verifying said non-interactive zero-knowledge proof against said local unencrypted identifier, to obtain either a successful or failed verification, and if said verification is successful, obtaining, from said first data source, first corresponding data that is associated with said local unencrypted identifier, wherein said first dataset comprises said first corresponding data. receiving, from a networked location, a first message comprising a first encrypted identifier that said first server is unable to decrypt; generating, from said first data source, a first dataset that may include data corresponding to said first encrypted identifier; and returning said first dataset to said networked location; characterised in that: said first encrypted identifier includes a non-interactive zero-knowledge proof, generated from an identifier stored on a second data source (302, 404, 405, 406) not connected to said first server; said method further comprising the step of generating a shared encryption key at the first server, wherein the shared encryption key is known to each of the plurality of servers but not to the networked location; and said step of generating said first dataset further comprising the steps of: obtaining, from said first data source, a set of at least one local unencrypted identifier; and for each local unencrypted identifier in said set: using said shared encryption key, verifying said first encrypted identifier against said local unencrypted identifier, by verifying said non-interactive zero-knowledge proof against said local unencrypted identifier, to obtain either a successful or failed verification, and if said verification is successful, obtaining, from said first data source, first corresponding data that is associated with said local unencrypted identifier, wherein said first dataset comprises said first corresponding data. said first encrypted identifier includes a non-interactive zero-knowledge proof, generated from an identifier stored on a second data source (302, 404, 405, 406) not connected to said first server; said method further comprising the step of generating a shared encryption key at the first server, wherein the shared encryption key is known to each of the plurality of servers but not to the networked location; and said step of generating said first dataset further comprising the steps of: obtaining, from said first data source, a set of at least one local unencrypted identifier; and for each local unencrypted identifier in said set: using said shared encryption key, verifying said first encrypted identifier against said local unencrypted identifier, by verifying said non-interactive zero-knowledge proof against said local unencrypted identifier, to obtain either a successful or failed verification, and if said verification is successful, obtaining, from said first data source, first corresponding data that is associated with said local unencrypted identifier, wherein said first dataset comprises said first corresponding data. obtaining, from said first data source, a set of at least one local unencrypted identifier; and for each local unencrypted identifier in said set: using said shared encryption key, verifying said first encrypted identifier against said local unencrypted identifier, by verifying said non-interactive zero-knowledge proof against said local unencrypted identifier, to obtain either a successful or failed verification, and if said verification is successful, obtaining, from said first data source, first corresponding data that is associated with said local unencrypted identifier, wherein said first dataset comprises said first corresponding data. using said shared encryption key, verifying said first encrypted identifier against said local unencrypted identifier, by verifying said non-interactive zero-knowledge proof against said local unencrypted identifier, to obtain either a successful or failed verification, and if said verification is successful, obtaining, from said first data source, first corresponding data that is associated with said local unencrypted identifier, wherein said first dataset comprises said first corresponding data.