A method for privacy-preserving computation of aggregated private data of a subgroup H of a group G of n client devices, the method comprising: a server selecting, preferably randomly selecting, a subgroup H of at least t client devices from a group G of n client devices, the server transmitting client information to at least each of the client devices of subgroup H, the client information including a set of client indices or information to determine a set of client indices, the set of client indices identifying the at least t client devices of subgroup H that have been selected by the server, the client information signalling each client device of subgroup H that the server would like to aggregate randomized encrypted private data of the at least t client devices, the randomized encrypted private data being generated by each of the client devices in the subgroup H using a random value r i associated with the client device, a public key (h, e) and an encryption function E of a homomorphic threshold cryptosystem with threshold t; the server receiving randomized encrypted private data and an associated decryption share, the decryption share being computed using a secret share d i of a decryption key d of the homomorphic threshold cryptosystem and either an exponentiation of the random values, or the aggregate R of the random values associated with each of the client device in the subgroup H, from client devices identified by the set of client indices, the decryption shares being configured such that the encrypted aggregated result can be decrypted on the basis of at least t decryption shares; and, the server aggregating, preferably summing or adding, the received randomized encrypted private data of the selected client devices using the homomorphic properties of the cryptosystem and using the decryption shares for decrypting the aggregated randomized encrypted private data into cleartext. a server selecting, preferably randomly selecting, a subgroup H of at least t client devices from a group G of n client devices, the server transmitting client information to at least each of the client devices of subgroup H, the client information including a set of client indices or information to determine a set of client indices, the set of client indices identifying the at least t client devices of subgroup H that have been selected by the server, the client information signalling each client device of subgroup H that the server would like to aggregate randomized encrypted private data of the at least t client devices, the randomized encrypted private data being generated by each of the client devices in the subgroup H using a random value r i associated with the client device, a public key (h, e) and an encryption function E of a homomorphic threshold cryptosystem with threshold t; the server receiving randomized encrypted private data and an associated decryption share, the decryption share being computed using a secret share d i of a decryption key d of the homomorphic threshold cryptosystem and either an exponentiation of the random values, or the aggregate R of the random values associated with each of the client device in the subgroup H, from client devices identified by the set of client indices, the decryption shares being configured such that the encrypted aggregated result can be decrypted on the basis of at least t decryption shares; and, the server aggregating, preferably summing or adding, the received randomized encrypted private data of the selected client devices using the homomorphic properties of the cryptosystem and using the decryption shares for decrypting the aggregated randomized encrypted private data into cleartext.