tl;dr
EU regulators have issued new guidance on blockchain and personal data processing under the GDPR. The European Data Protection Board (EDPB) advises evaluations on blockchain use, focusing on whether personal data is involved, the necessity of blockchain, the type of blockchain, and privacy measures....
The European Data Protection Board (EDPB) has issued new guidance requiring thorough evaluations of blockchain data processing to ensure compliance with the EU’s General Data Protection Regulation (GDPR). These evaluations focus on whether the blockchain contains personal data, the necessity of blockchain for such processing, the type of blockchain used, and the privacy measures implemented.
The EDPB emphasizes that blockchains must comply with GDPR principles, including the critical requirement for data deletion. Since data deletion at an individual level is challenging on blockchain networks, especially public ones, the guidance suggests that entire blockchains might need to be deleted if personal data cannot be erased properly. This aspect could pose significant legal challenges for public blockchains like Ethereum.
James Smith, special projects lead at the Ethereum Foundation, warned that these regulations could threaten the fundamental architecture of public blockchains. He highlighted concerns that the new framework may misunderstand decentralized technology and potentially restrict Ethereum’s lawful operation within the European market.
The guidance urges blockchain developers and operators to consider:
i. Whether the blockchain data will contain personal information.
ii. Why blockchain is necessary for the data processing, including alternatives.
iii. What type of blockchain should be used, such as private, permissioned, or zero-knowledge architectures.
iv. The technical and organizational measures, including on-chain and off-chain storage and the use of privacy-enhancing technologies.
In summary, the EDPB reinforces that blockchain technology is subject to GDPR rules, and failure to integrate data deletion capabilities at design could result in the need to erase entire blockchain networks. This regulatory stance introduces substantial implications for public blockchains and represents a pivotal moment for blockchain governance and compliance in the EU.