Blockchains and the General Data Protection Regulation

Abstract

Blockchain technologies have emerged as a revolutionary way of executing business processes in a decentralised way. Spearheaded by their use as cryptocurrency as a way to transact digital assets without the need of a bank blockchains have attracted the attention of the general public and mainstream media. Beyond cryptocurrencies, large companies, entrepreneurs, and investors have recognized the potential of the underlying technologies as a game-changer in the way we formalise and manage digital relationships in the Web. According to the Worldwide Semiannual Blockchain Spending Guide published by IDC, blockchain technologies received $945M of investment in 2017, and are estimated to get a staggering $2.1 billion by the end of 2018. In parallel, the European Union has recently introduced the General Data Protection Regulation (GDPR) to protect and empower all EU citizens data privacy and to reshape the way organizations across the region approach data privacy, with particular emphasis in reducing the power asymmetry between organisations that manage and exploit personal data, and the individual to which these data belongs. Unfortunately, despite the fact that from a philosophical perspective blockchains also pursue the empowering of individuals and reducing the influence of centralised parties, several scholars and practitioners have raised concerns about the conflict between the way blockchains work and some articles of the GDPR. This ‘collision course’, as some enthusiasts and developers have called, on the one hand generates anxiety about the possibility that GDPR might hinder European innovation in blockchain technologies, while on the other, opens potential opportunities in the use of blockchain technologies as a tool for enforcing GDPR. In this paper, we review the legal and technological state of play of the GDPR-Blockchain relationship. Next, we analyse three interaction scenarios between data subjects and blockchain systems, and propose possible ways of achieving GDPR compliance by using state of the art technologies. Finally we review current efforts in the use of blockchains to enforce GDPR principles, in particular ‘Data Protection by Design’