an information storage system includes one or more information update terminals , a mapper , one or more partial - databases , and one or more query terminals , exchanging messages over a set of communication channels . an identifier - mapping mechanism provides a method for delegating control over retrieval of the data stored at the partial - databases to one or more mappers , typically operated by one or more trusted third parties . update terminals supply information , that is stored in fragmented form by the partial - databases . data - fragment identifiers and pseudonyms are introduced , preventing unauthorized de - fragmentation of information -- thus providing compliance to privacy legislation -- while at the same time allowing query terminals to retrieve the stored data or learn properties of the stored data . the mapper is necessarily involved in both operations , allowing data access policies to be enforced and potential abuse of stored information to be reduced . introduction of multiple mappers acts to distribute information retrieval control among multiple trusted third parties . introducing so - called ` groupers ` increases the efficiency of data retrieval for a common set of queries and further reduces potential abuse of information .