Private Blockchain and cookies

Introduction

Anyone who has read texts related to blockchain technology will have noticed how this infrastructure meets multiple use cases in different sectors. From FinTech to Manufacturing, in B2B and B2C, where there is a need to obtain the immutability of information, which translates into the certainty of transactions, the blockchain provides information with a strong alternative guarantee, compared to the individual centers of power that have formed spontaneously or have been authorized to control the legitimacy of operations.

The Timestamp mechanism, the timestamp that attests to immutability, helps make it an alternative and secure infrastructure, as the information is also decentralized and encrypted. For these reasons, it is difficult to destroy, alter, and share outside the network.

The regulatory context

In relation to the regulation on the protection of personal data (GDPR – Regulation no. 679/2016), this type of technology has been the subject of careful analysis on several occasions. Moreover, the National Commission on Informatics and Freedoms, known as CNIL, already in 2018, analyzed whether and how the obligations imposed by the Regulation (EU) can be implemented or violated in the context of a blockchain.

The blockchain, when both the purpose and the means, must comply with regulatory frameworks, and any gap with them cannot and, above all, must not be overlooked.

The current point in privacy

To understand how the blockchain can drastically change not only the exercise but also the existence of a right in the field of data protection, it is necessary to imagine the lifecycle that our personal data currently undergoes, such as our name and surname, which normally circulates among several Controllers and chains of Processors, who communicate it to as many Sub-processors.

These transfers take place between authorizations and prohibitions on processing, linked to assumptions concerning the type of data, the category of the data subject, and the identification of the purposes of processing.

Moreover, the processing takes place within and outside the European borders, where the adequacy of the legislation of the State of destination of the data regarding the protection of privacy is evaluated. Let us remember that our data travels through our consents and refusals to the individual processing.

It follows that behind a request for access by a Data Subject, there is an organizational complexity that has a strong impact on the process of preparing the response by the Controller.

Currently, when the Data Subject exercises the right of access (art. 15 par. 1 GDPR), he or she turns to the Controller to confirm whether or not processing of personal data concerning him or her is underway and to indicate to whom it is communicated. Although this request, protected by the norm with an absolutely guaranteeing logic, activates a cumbersome internal and external process in the Controller, involving various offices to trace the path taken by that name and surname.

Blockchain as a privacy-by-design tool: obstacles and advantages

The blockchain itself is a solution to the problem exposed. Our data could well be entered and circulated in an encrypted blockchain infrastructure. The advantage would be to be able to verify at any time where it is located, who owns it, and the subsequent transactions that occur on it. Moreover, by means of the application of smart contracts, it is possible to foresee the conditions of authorization or denial of the same processing.

The objections to the use of this technology, raised by European authorities, researchers, and scholars in the field, are that the blockchain, by its very nature, does not allow the exercise of the right to rectification and erasure of the data (Art. 16 and 17 GDPR).

On one hand, the objection concerning the right to deletion could be addressed by eliminating the data decryption algorithm, which would make it difficult and economically burdensome to alter the data. On the other hand, the objection regarding the right to rectification could be overcome by overwriting the data on the network.

Such solutions would be feasible only in the permissioned model, as it would create an environment focused on the data controller rather than a data-centric environment. This would involve fewer subjects, namely those directly involved with the data controller and not all subjects related to the data of the data subject.

It should be noted that the application of blockchain encounters less regulatory resistance in the management of cookies, where rules can be predefined and the exercise of the right to rectification, as regards navigation data, has no significant applicative developments. In this context, the chain of actors involved in the processing, listed in the preceding paragraph, is the same.

In the management of cookies and therefore, the passage of information, blockchain would be a tool placed, on the one hand, to guarantee the legitimate circulation of data through Smart Contracts in which the types of cookies are established, namely the classification and authorizations, and on the other hand, to control by the data subject the lawfulness of the path of their navigation data.

This solution addresses issues for which there are currently multiple regulatory interventions, which require greater attention to compliance aspects related to data processing and transfer to third countries. Remember the Guidelines on Cookies of the Italian Data Protection Authority of June 10, 2021, and the decision of the Austrian Data Protection Authority of December 22, 2021, which sanctions the use of Google Analytics.

Conclusion Despite the multiple technological solutions to comply with the formal obligations provided by European data protection regulations, only a few of them provide a substantial contribution in implementing the regulations. Blockchain is a tool that can support the data controller and the data subject in the process of implementing the principle of privacy by design and by default.

For this reason, it must be the subject of constant study and in-depth analysis in order to update the point of intersection between technological development and regulatory context.