A data sharing method to be executed by a data sharing system comprising n communication terminals, wherein n is an integer equal to or larger than 2, sharing data, a data sharing server recording encrypted data obtained by encrypting the data to be shared by any of the n communication terminals and a key generation server generating a public parameter for use by the communication terminals, for updating an encrypted session key obtained by encrypting a session key shared among the communication terminals sharing the data, the data sharing method comprising: a generation identifier generation step (S520) of the data sharing server generating a generation identifier showing a generation of the group, wherein the generation identifier is generated each time a composition of members of the group changes and is shared among the n communication terminals; a session key encryption step (S530, S540, S550) of a communication terminal to perform encrypted session key update, the communication terminal being any of n-1 communication terminals except the communication terminal used by a user using any of the n communication terminals who has left a group composed of users using the n communication terminals and including a recording part in which the public parameter and a currently valid session key are recorded, using the generation identifier received from the data sharing server and the public parameter and the session key recorded in the recording part to generate an encrypted session key, which is the session key that has been encrypted; and an encrypted session key management step (S560, S570) of the data sharing server recording the encrypted session key received from the communication terminal to perform encrypted session key update as a currently valid encrypted session key; and the data sharing system updating the encrypted session key when the user leaves the group, in order that the user who has left the group cannot decrypt the encrypted data. a generation identifier generation step (S520) of the data sharing server generating a generation identifier showing a generation of the group, wherein the generation identifier is generated each time a composition of members of the group changes and is shared among the n communication terminals; a session key encryption step (S530, S540, S550) of a communication terminal to perform encrypted session key update, the communication terminal being any of n-1 communication terminals except the communication terminal used by a user using any of the n communication terminals who has left a group composed of users using the n communication terminals and including a recording part in which the public parameter and a currently valid session key are recorded, using the generation identifier received from the data sharing server and the public parameter and the session key recorded in the recording part to generate an encrypted session key, which is the session key that has been encrypted; and an encrypted session key management step (S560, S570) of the data sharing server recording the encrypted session key received from the communication terminal to perform encrypted session key update as a currently valid encrypted session key; and the data sharing system updating the encrypted session key when the user leaves the group, in order that the user who has left the group cannot decrypt the encrypted data. <EOS>