{"id":58289,"date":"2018-11-07T09:12:24","date_gmt":"2018-11-07T09:12:24","guid":{"rendered":"https:\/\/blogs.dlapiper.com\/iptitaly\/?p=58289"},"modified":"2019-06-24T14:57:05","modified_gmt":"2019-06-24T12:57:05","slug":"how-can-the-blockchain-become-gdpr-compliant","status":"publish","type":"post","link":"https:\/\/blogs.dlapiper.com\/iptitaly\/2018\/11\/how-can-the-blockchain-become-gdpr-compliant\/","title":{"rendered":"How can the blockchain become GDPR compliant?"},"content":{"rendered":"

Blockchain compliance with GDPR requirements was tested by the French privacy authority and the European Commission, with uncertain outcomes.<\/p>\n

Blockchain<\/a>\u00a0privacy compliance is a very hot topic that led to\u00a0major discussions. The compliance of the impossibility to remove information from the distributed ledger with the GDPR\u2019s right to be forgotten for instance has been challenged in several instances. But this is only one of the topics now covered by the French data protection authority, the\u00a0CNIL<\/a>, in its guidelines on the topic (which were covered\u00a0here<\/a>\u00a0on DLA Piper Privacy Matters blog by my colleagues\u00a0Denise Lebeau-Marianna<\/a>\u00a0and\u00a0Caroline Chanc\u00e9<\/a>) and by the EU Blockchain Observatory and Forum of the European Commission in a\u00a0workshop report<\/a>\u00a0recently issued.<\/p>\n

Below are the most interesting insights arising from those documents and my personal view on them:<\/p>\n

Does the GDPR apply to blockchain?<\/h2>\n

Transactional data recorded on a blockchain that can be linked to an individual are likely to fall under the category of personal data.<\/p>\n

More debated is whether the same conclusion applies in relation to public keys. A\u00a0public key<\/a>\u00a0is cryptographically connected to a cryptocurrency address in the sense that the address is a representation of the public key.\u00a0The public key can be thought of as being an individual\u2019s bank account, whilst the private key is the secret PIN to that bank account. The private key is used to generate the public key, but the process is irreversable and therefore none can calculate the private key from the public key.<\/p>\n

It can be argued that the public key is still an information linked to an individual. But the issue is whether \u2013 given the level of complexity of the public key \u2013 it is likely that such information can be connected to the relevant individual.<\/p>\n

If we take an example the bank account number, this will be personal data for the bank where the account holder has his bank account, but, for any other individual, that information is unlikely to be personal data since they are not able to link that information to anyone. Indeed,\u00a0pseudonimized data (such as public keys) under the GDPR are personal data only if individuals are identifiable<\/strong>\u00a0taking into account<\/p>\n

\u201call the means reasonably likely to be used, such as singling out, either by the controller or by another person to identify the natural person directly or indirectly<\/em>\u201c.<\/p><\/blockquote>\n

Who is the data controller on a blockchain?<\/h2>\n

The CNIL considers that participants to a blockchain (i.e. the persons who can write on the blockchain and create a transaction that is submitted for validation) act as data controllers where:<\/p>\n