Method for anonymous compiling of confidential data and related identification data of persons, wherein the following steps are carried out per data record: - on behalf of a user (10, 11): - converting the identification data into a first record identifier and - transmitting the first record identifier together with the confidential data to a trusted third party, - on behalf of the trusted third party: - re-encrypting the first record identifier into a second record identifier by means of a symmetric key, and - transmitting the second record identifier together with the confidential data to a feature database, wherein the identification data are also stored in a linking database, together with link data that indicate relations between identification data of different records, including link data that specify that the identification data of two different data records, which identification data are different from one another, refer to the same person, or which specify that a certain relation exists between persons associated with the different data records, and the following additional steps are carried out: - on behalf of the linking database: - converting the identification data into a third record identifier such that the third record identifier implicitly includes the first record identifier for the same identification data, and - transmitting the third record identifier to the trusted third party together with the link data, - on behalf of the trusted third party: - re-encrypting the third record identifier into the second record identifier, and - transmitting the second record identifier to the feature database together with the link data. - on behalf of a user (10, 11): - converting the identification data into a first record identifier and - transmitting the first record identifier together with the confidential data to a trusted third party, - converting the identification data into a first record identifier and - transmitting the first record identifier together with the confidential data to a trusted third party, - on behalf of the trusted third party: - re-encrypting the first record identifier into a second record identifier by means of a symmetric key, and - transmitting the second record identifier together with the confidential data to a feature database, - re-encrypting the first record identifier into a second record identifier by means of a symmetric key, and - transmitting the second record identifier together with the confidential data to a feature database, - on behalf of the linking database: - converting the identification data into a third record identifier such that the third record identifier implicitly includes the first record identifier for the same identification data, and - transmitting the third record identifier to the trusted third party together with the link data, - converting the identification data into a third record identifier such that the third record identifier implicitly includes the first record identifier for the same identification data, and - transmitting the third record identifier to the trusted third party together with the link data, - on behalf of the trusted third party: - re-encrypting the third record identifier into the second record identifier, and - transmitting the second record identifier to the feature database together with the link data. - re-encrypting the third record identifier into the second record identifier, and - transmitting the second record identifier to the feature database together with the link data.