Can GDPR Disrupt Blockchain Technology?
Guest postsGuest post2 min read
The General Data Protection Regulation (GDPR) creates a unified privacy standard that harmonizes disparate legal frameworks across Europe for more than half a billion people. The regulation has raised many questions about its compatibility with blockchain technology, which has a high potential for development but also contains personal data that falls under GDPR's purview.
The fundamental tension lies in blockchain's immutability - once data is stored on a blockchain, it can't be removed or altered. This conflicts directly with the GDPR's "right to be forgotten," which grants individuals the right to have their personal data erased under certain conditions.
The GDPR is not designed to regulate technologies themselves, but instead governs how organizations and individuals apply those technologies when dealing with personal data. "Given that they are new forms of data storage and management, questions surrounding the relation between blockchains and the EU's General Data Protection Regulation (GDPR) abound."
This carries high-stakes consequences for companies that develop blockchain systems. If EU personal data is added to a blockchain, even by mistake, it cannot be deleted, exposing developers to severe GDPR penalties and potentially destroying the project.
Organizations that fall under the scope of the GDPR are subject to varying requirements. Entities are classified as either controllers or processors, with controllers bearing far greater duties, including handling requests from individuals to update, delete, or transfer their personal records.
Despite these challenges, there are technical solutions and regulatory guidance emerging to help blockchain solutions comply with GDPR. The French data protection authority CNIL has held discussions with solution providers and put forth its own analysis and recommendations, noting that private blockchains do not raise specific compliance issues. It also suggests stakeholders carefully consider whether blockchain is necessary for their data processing, and to evaluate technological solutions that can help comply with GDPR requirements, such as controlling data access based on format.
Preventing a clash will require favorable interpretations by EU regulators so that the EU and its citizens can still benefit from blockchain technology. For those willing to invest in the right technical architecture and legal review, though, it is possible to bring blockchain solutions into GDPR compliance.
This column was written by an outside contributor. Views are the author's own and do not necessarily reflect those of Bit News Today.
