Blockchain and Privacy: two parallel lines destined never to meet?

Introduction:

The blockchain system is represented by a composite set of technologies in which the register is structured as a chain of blocks containing the transactions made by users. In this complex process, validation is entrusted to a precise mechanism determined by a specific consensus, which is divided relative to the various operators of the network on all authorized nodes that will be inserted in the register of the aforementioned validation.

With a healthy prosaic realism and above all synthetic, the blockchain can be defined as a “chain of blocks” that manages to create a digital register and the related operations, such as a transaction or sale in virtual currency, which are controlled by multiple operators in such a way that their authenticity can be guaranteed.

With the introduction of the GDPR (General Data Protection Regulation) European Regulation n.679/16 in the field of personal data protection, as subsequently emphasized by the European Parliament in the Resolution of 3 October 2018, it is evident that for this type of registration technology, the issues related to the principles of accountability (awareness of processing) and the principle of privacy by design with reference to the blockchain must be adequately addressed.

Blockchain and GDPR:

Specifically, personal data contained within a blockchain cannot be modified unless all hierarchically adequate blocks are involved. In any case, European regulations regarding privacy protection provide that a single user can request the modification of such data, and personal data inserted in a blockchain is public and consultable by all participants, but it is not guaranteed that a user has indicated that such data can be accessed concretely.

Indeed, with the definition of “personal data,” any type of information that can be attributed to a specific individual is generally understood, according to art. 4 of the GDPR. It is easy to deduce how conflicts can arise with the blockchain, as a distributed and layered system that can potentially be uncontrollable; and consequently, the complete protection of personal data, as stated by European privacy regulations, is not guaranteed.

Regarding the issue, managing potential bugs related to the same data, which represent the logical premise deriving from an inflexible “chain” for decisive security reasons, could become extremely complex. In any case, personal data cannot be kept forever, and the eventual deletion in compliance with European regulations would be particularly complicated.

DPO and Blockchain:

The new legal figure specifically developed by the European Regulation regarding privacy, namely that of the DPO (Data Protection Officer), is a professional with specific technical and legal skills whose primary function is to verify that all participants in a system in which personal data are managed (including a chain of blocks) observe the regulations regarding the processing of personal data.

On the other hand, it is worth mentioning the fact that a centralized control undermines the principle of the blockchain itself.

Another relevant issue concerns the relationship between the Blockchain and the so-called right to be forgotten. According to a study conducted by the Queen Mary University of London, a GDPR-compliant blockchain should be hypothesized by means of appropriate encryption of personal data with subsequent elimination of the corresponding decryption keys, so that only indecipherable data can be left or by using so-called off-chain memory models.

Similarly, anonymization also proposes numerous problems since in a blockchain, everything is encrypted, but it can still be violated, and consequently, personal data may be exposed to risks.

The anonymization also presents numerous issues as in a blockchain, everything is encrypted, but it can still be violated, and personal data can be exposed to risks.

In conclusion, one of the most forward-looking solutions could be to allow the data to be entered into a blockchain only as an external link so that the information remains outside the blockchain.

——-——-——-——-——-——-——-——-——-——-——-——-——-——-——-——-——-——-

1 www.bucap.it/news/approfondimenti-tematici/digitalizzazione-documenti/blockchain-e-privacy.htm.

2 www.agendadigitale.eu/sicurezza/blockchain-e-privacy-soluzioni-per-la-compliance-alle-norme.

3 www.privacylab.it/IT/345/Cosa-significa-accountability%3F/.

4 The GDPR gives EU citizens the right to: delete personal data when it is no longer necessary for the purpose of collection and to ask for correction of incorrect data; limit the processing or use of personal data.

5 In fact, as Article 17 of the GDPR states: “The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller shall have the obligation to erase personal data without undue delay.”