Blockchain System and GDPR, critical issues and possible solutions.

One of the most debated topics in the digital sector recently is that of Blockchain, but what does this new system mean? What use can it have, and above all, can it be legitimate in view of the privacy regulations introduced with European Regulation No. 679/2016?

The Blockchain system is part of the Distributed Ledger macro technology, i.e., platforms based on a distributed register, which can be consulted and modified by multiple nodes in a network, and in the absence of a central manager, must gather consents in view of modifying the same data. The consent in this sense, as well as the structure assigned to the registers, depend on the peculiarities of the different Distributed Ledger technologies.

Therefore, we can synthetically define the Blockchain system as a set of technologies in which all data related to transactions between different subjects are collected and validated through the consents collected between the validations of the same that occurred at the level of the various nodes of the network, using a chain of blocks.

Although it is a tool born in the world of cryptocurrencies, its enormous potential and the evolution it seems destined to have are undeniable.

However, due to the mechanism by which registers are formed with the Blockchain system, numerous critical issues arise regarding its legitimacy in light of the privacy directives introduced with European Regulation No. 679/2016.

To try to understand what the collision profiles are between GDPR and the Blockchain system, it is necessary, first of all, to focus attention on the concept of “personal data” relevant for the applicability of European regulations. The latter, in fact, defines personal data at Art. 4(1) as “any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.” In this way, the principles of data protection established by the legislation do not apply in the face of anonymous information or personal data made sufficiently anonymous.

Therefore, if things are so in the current legislation, it is not the entire Blockchain system that poses profiles of illegitimacy but only some of its implications.

In fact, as already mentioned in the opening of this article, the Blockchain technology allows transactions between parties without revealing the identities of the subjects involved so that, from that point of view, it falls within the scope of personal data made sufficiently anonymous that, as such, falls outside the GDPR. The problem arises when, once the transaction is concluded, it is published and linked to a public key that represents a user’s pseudonym, and it is precisely this public key that could lead to the identification of the users involved in the transaction operation. Therefore, it is precisely the public key that, once associated with a certain user, can give rise to the definition of personal data referred to in Art. 4 of Regulation No. 679/2016.

The shift from anonymous data to personal data leads to the need, in order to comply with privacy regulations, to identify the data controller to whom the data subject can potentially turn to enforce their rights. However, considering that the Blockchain system is based on the creation of decentralized solutions, and that Permissioned Blockchain and Distributed Ledger platforms are designed to be managed by different parties, all of which can impact the purpose of the use of collected data, it does not seem too easy to limit the figure of the data controller and data processor to a single level.

In light of this critical issue, the European Parliament has initiated a study aimed at finding a workable solution to three policies, making it clear that the compatibility between the Blockchain system and the GDPR regulations must be analyzed with regard to individual cases, highlighting further points of friction between the two areas.

If articles 16 and 17 of EU Regulation No. 679/2016 allow the owner to request the deletion or modification of their inaccurate data, it must be remembered that the Blockchain system works with data that, once collected and stored, are mostly immutable, with further tensions regarding the right to be forgotten, as well as the principle of minimization of the use of personal data.

The solutions proposed by the European Parliament move in three directions.

Firstly, at an institutional level, there is an opportunity to introduce an interpretive regulation aimed at offering harmonious guidelines for the entire European Union system, allowing the principles of the GDPR to be applicable to the digital sector, perhaps with the introduction of guidelines at the level of the European Data Protection Board.

Secondly, the attention of the Strasbourg Parliament shifts to the operators, hoping for the adoption of Codes of Conduct by operators and certification systems for chains, in compliance with articles 40 and 42 of the GDPR, sectoralized in such a way as to respond to the needs of the individual reference area.

Lastly, there is a need for interdisciplinary research approaches to overcome the impasse arising from the diversified governance mechanisms and to coordinate the decentralized networks of the Blockchain system.

Since the time of these reflections, the work of the European Parliament has led to Resolution No. 2772/2017 regarding “distributed ledger technologies and Blockchain,” in the context of which Blockchain technology has been evaluated as a tool aimed at strengthening citizens’ autonomy by giving them the opportunity to control their data and decide which to share in the registry, as well as the possibility of choosing who can see such data, thus promoting transparency of the underlying transactions. On that occasion, however, the proximity between GDPR and Blockchain was clarified, where both share the same guiding principles: to guarantee data security and to return to interested parties the arbitrariness over the same.

In the opinion of the writer, however, more than a resolving intervention, that of the European Parliament seems, rather, a timid attempt to mitigate the compatibility issues between the two sectors, now highlighting profiles of more than ever dissonant similarity.

That is to say, undoubtedly the Blockchain system is to be encouraged and favored in its evolution, which, according to the writer, can only be inevitable and pandemic, but it is certainly necessary to provide legislative mechanisms of control and evaluation regarding the use of data collected to be addressed, first of all, to the provider of processing and storage resources and then to be extended to the various decentralized systems that impact the processing and use of the data thus collected; only in this way can there be harmony between Blockchain and GDPR, certainly not wanting to suggest nonexistent similarities.