On 12 July 2019 the European Parliament released its report on Blockchain and the General Data Protection Regulation. The report aims to clarify the existing tensions between the rights of data subjects and blockchain technology and propose solutions, while reassuring its proponents that the EU institutions recognise the potentially game-changing applications for blockchain technology across multiple industries, as was addressed in a European Parliament Resolution of 3 October 2018.
The GDPR is principles-based and these principles inform everything that flows from their application, including its scope to be technology neutral, as is expressly mentioned in recitals, and thus future proof. Blockchain technology is built on blocks of digital information, or nodes, that are distributed across multiple data controllers. Each node builds on the last and, to maintain the integrity of the chain, cannot be modified or altered after each transaction is completed.
The challenges that blockchain’s presents to the GDPR framework are immediately apparent. The GDPR is built on the presumption of an identifiable data controller, or joint controllers, who is accountable for how personal data is processed. Moreover, the technical specificities of the blockchain model are not easily aligned with data subjects’ rights to rectification or erasure of personal data, or the right to be forgotten. As the technology creates a perpetual ledger, principles such as data minimisation and storage also fall foul.
The report also identifies various ways in which blockchain can be used to advance GDPR objectives; without the need for a single (or joint) data controller, it offers transparency over who has accessed data. Data subject rights of access and portability are facilitated by the technology. Ultimately, where blockchain technology has been in the processing of personal data, its compliance with GDPR should be assessed on a case-by-case basis taking into consideration factors such as the context (public v private) and whether the encryption of the data meets the threshold for anonymisation.
The above-mentioned EP resolution makes it clear that there is an explicit intention to support the adoption of blockchain technology across the EU. For GDPR compliance the report proposes regulatory guidance, codes of conduct and certification mechanisms to provide guidance. Alternately, research funding could made available for interdisciplinary research on blockchain protocols that could be ‘compliant by design’.
What is clear is that at present there is nothing concrete in the pipeline that will assuage the concerns of privacy advocates and the question remains – where there is a will can a way be found?