Blockchain technology applied to privacy: roles and solutions.

Intro.

The entry into force of EU Regulation 679/2016 on May 25, 2018, has once again drawn attention to the principles of protecting personal data, which today are viewed with greater interest and relevance. The new concepts introduced, such as accountability, privacy by design, data breach, data retention, anonymization, minimization, pseudonymization, and the right to be forgotten (just to name a few), have highlighted the new modes of processing and the potential vulnerabilities of our data, as well as the damages, before sanctions, resulting from their lack of protection and/or incorrect treatment. They have also indicated how the correct management of personal data constitutes a continually evolving path that involves various interconnected areas.

At the same time, the rise of disruptive technologies, in particular blockchain, with its unstoppable technological evolution, makes the coexistence of respective principles difficult in some cases.

Contrasts.

Some of the differences concern the decentralized nature of blockchain, the immutability and traceability of the data contained therein, albeit anonymized and protected, which do not always reconcile with those provided for by the GDPR precisely because, on the contrary, it requires the centrality of data, the precise identification of all active subjects, i.e., the methods of storage and processing, modification, and deletion (if requested).

In relation to active subjects, the difficulty of establishing with certainty the roles and responsibilities covered by the various actors operating in a blockchain (especially permissionless) is evident, as required by GDPR principles which, once again, due to the decentralized nature of this technology, cannot be identified.

While in the blockchain, the need for identification responds to a technical need for certainty of the transaction, security, anonymity, and verifiability so that it can be successful and guarantee the smooth running of the entire network. In GDPR, this need is aimed at protecting personal data and the consequent attribution of responsibility in case of violation.

The figure of the “data controller” is defined by the regulation as “the natural or legal person, public authority, service, or other body that, individually or together with others, determines the purposes and means of processing personal data” (1) and must therefore be identified within a blockchain among all network participants.

Therefore, for example, each node in the network can be considered a data controller (holder) for itself and a data processor (responsible) for the other nodes, at the same time covering two different roles with different obligations and responsibilities that are difficult to adapt to the GDPR paradigm.

It is easy to understand how, in relation to the different and multiple figures operating within a blockchain (miners, oracles, end-users, Blockchain Service Providers, Exchanges, etc.), this classification is difficult to apply.

These differences in roles intensify even more when different types of “blockchain networks” are added to the mix, such as the most representative, “permissioned blockchain” and “permissionless blockchain.”

While for the first type, two hypotheses of specific cases have been identified by some, namely: 1) when a natural person decides to participate in a consortium with the management of a closed blockchain, in which case this subject will accept in advance that all participants will be able to process the data that he/she will enter into the network and in turn validate transactions of others. The “joint data controllership” provided for in Article 26 of the GDPR will be applied, with the signing of an agreement between all participants to regulate their respective responsibilities; 2) when a consortium offers services to end-users by registering all data on a “permissioned” blockchain, even in this case, joint data controllership will be used, and end-users will be classified as data subjects (2). For the second type, such classification will appear decidedly more complex due to the strong decentralization that characterizes a permissionless network and the multitude of actors involved in the entire cycle of a “transaction” without the possibility of identifying well-defined roles and responsibilities.

Solution.

To date, we have seen how several technical proposals have been presented, leading to equally effective solutions that, albeit not exhaustive and resolving all possible obstacles, trace the path to the necessary coexistence between technology and regulations.

The “off-chain storage,” which seems to be the most rapidly implementable solution, allows sensitive information to be stored in an archive (database) external to the ledger used only as a subsequent mechanism for verifying the integrity and accessing the original data, and for this reason, the choice does not fall on a normal database. This external memory to the “blockchain” allows to keep the actual information (and personal data) separate from its corresponding hash value, which will be materially recorded in the ledger. In this way, it aims to keep the original data safe, protecting the information it contains, and using it only for accessibility and integrity verification operations required by the network operations.

The “zero-knowledge proof” (ZKF) is a promising technique to support privacy management in blockchain, providing a higher degree of security and anonymity.

It consists of the possibility for one subject to prove to another subject that a statement (usually mathematical) is true without revealing anything else beyond its veracity (4).

This technique proves to be particularly useful, especially in permissionless blockchains, which, due to their completely public nature, would require the need to keep some information confidential by obscuring them within the transactions themselves. Even more useful and faster to implement, needless to say, in private blockchains where, for the management of confidential inter-company processes, organizations can keep the information necessary for their interaction private, using blockchain as a validation and control tool through their notarization (5).

Conclusions.

It is important to remember that EU Regulation 679/2016 has introduced several principles to maximize “privacy” protection, for this reason, it is hoped that equally effective solutions will be developed in the future for each of the new concepts introduced with the GDPR. Specifically, it is desirable that there is a parallel development of technical solutions and regulations without further delays.

All disruptive technologies, and in particular, the blockchain, which in recent years has characterized technological advancement, are already part of many activities that we only called “future” a few years ago. All these interconnected technologies are already developing very fast-growing processes that evolve enormously and with very short timing, which in some cases create new markets with exponential potential. To this end, an immediate adaptation of the regulatory, bureaucratic, and operational framework in our country becomes of fundamental importance and a privileged opening towards blockchain as an indispensable technological lever.

Dr. Americo De Gruttola

Bibliography.

1. EU Regulation 679/2016, art.4, co1, n.7;
2. “Blockchain Law, Artificial Intelligence and IoT” by Fulvio Sarzana di S.Ippolito and Massimiliano Nicotra, IPSOA – Wolters Kluwer, 2018 – pages 76,77;
3. Luis-Ibanez, Kieron O’Hara and Elena Simperl – “On Blockchains and the General Data Protection Regulation”;
4. Fabrizio Baiardi and Cosimo Comella – “GDPR and blockchain, all the challenges of a complex relationship” | Digital Agenda of 04.08.2021;
   Zero-knowledge proof – Wikipedia;
5. Nicola Attico – “Enterprise Blockchain: Legaltech and other tools for professionals and businesses.” GueriniNext (2021) pp.121,122.