A method of mining privacy-sensitive data, comprising the steps of: a) formulating a query with at least one condition, b) comparing an initial set of privacy-sensitive data against the at least one condition in the query, and generating a list of specific instances within the initial set of privacy-sensitive data that satisfy the at least one condition, c) transmitting the list via an electronic data communications topology to at least one data source entity having privacy-sensitive transactional data, d) matching, by the at least one data source entity, specific instances on the list with corresponding items in the privacy-sensitive transactional data, e) de-identifying, by the at least one data source entity, the matched specific instances and corresponding items in the privacy-sensitive transactional data, f) electronically transmitting, by the at least one data source entity, at least one file containing the de-identified, matched specific instances and corresponding items in the privacy-sensitive transactional data, to an aggregator, g) merging, by the aggregator, the at least one file into a combined result responsive to the query, wherein at least one data consumer entity or at least one data originator entity or the aggregator formulates the query; characterised in that: the at least one data consumer entity or the at least one data originator entity generates the list of specific instances from the initial set of privacy-sensitive data; the aggregator is prevented from accessing the initial set of privacy-sensitive data at the at least one data consumer entity or the at least one data originator entity, and is prevented from accessing the content of the list of specific instances generated from the initial set of privacy-sensitive data; whereby the entity that generates the list of instances transmits the list of instances directly to the at least one data source entity, and/or whereby the entity that generates the list of instances encrypts the list of instances and transmits the encrypted list of instances to the aggregator that forwards it to the at least one data source entity that decrypts the encrypted list of instances. a) formulating a query with at least one condition, b) comparing an initial set of privacy-sensitive data against the at least one condition in the query, and generating a list of specific instances within the initial set of privacy-sensitive data that satisfy the at least one condition, c) transmitting the list via an electronic data communications topology to at least one data source entity having privacy-sensitive transactional data, d) matching, by the at least one data source entity, specific instances on the list with corresponding items in the privacy-sensitive transactional data, e) de-identifying, by the at least one data source entity, the matched specific instances and corresponding items in the privacy-sensitive transactional data, f) electronically transmitting, by the at least one data source entity, at least one file containing the de-identified, matched specific instances and corresponding items in the privacy-sensitive transactional data, to an aggregator, g) merging, by the aggregator, the at least one file into a combined result responsive to the query, the at least one data consumer entity or the at least one data originator entity generates the list of specific instances from the initial set of privacy-sensitive data; the aggregator is prevented from accessing the initial set of privacy-sensitive data at the at least one data consumer entity or the at least one data originator entity, and is prevented from accessing the content of the list of specific instances generated from the initial set of privacy-sensitive data; whereby the entity that generates the list of instances transmits the list of instances directly to the at least one data source entity, and/or whereby the entity that generates the list of instances encrypts the list of instances and transmits the encrypted list of instances to the aggregator that forwards it to the at least one data source entity that decrypts the encrypted list of instances.