A method for executing searches for resources that span more than one private resource repository in a restricted-access resource sharing system is disclosed. The system includes at least one server node and multiple peer nodes connected to a network. Resources, such as data digital images, may be retrieved from the nodes based by issuing queries containing terms matching the metadata associated with the resources. The method includes maintaining storage of resources and associated metadata on respective peer nodes, wherein the associated metadata is based on at least one metadata vocabulary. Each of the peer nodes is allowed to indicate to the server that the metadata vocabularies associated with the resources are designated as private, thereby becoming a restricted access peer node. If a first restricted access peer node specifies to the server which metadata vocabularies the first restricted access peer node supports, a first level of privacy is provided whereby search queries received by the server that use the specified metadata vocabularies are passed to the first respective restricted access peer nodes for processing, while searches that do not use the specified vocabularies are processed by the server. If the first restricted access peer node does not specify to the server which metadata vocabularies the first restricted access peer node supports, a second level of privacy is provided whereby search queries received by the server are passed to the first respective restricted access peer nodes for processing.