EU Urges Blockchain Creators to Focus on Data Security and Privacy in Developments
New and Improved Guide:
Hear this loud and clear, EU regulators have set their sights on blockchain networks and their handling of personal data. The European Data Protection Board (EDPB) has dropped some fresh guidance, stressing that blockchain projects must comply with the same General Data Protection Regulation (GDPR) rules as any other data processor.
Tip:GDPR rules apply to blockchain technology projects in the EU, require data erasure, and encourage privacy-enhancing tech solutions and permissioned chains.
The EDPB report spells out specific criteria blockchain operators should keep in mind when striving for GDPR compatibility. They're after a detailed assessment of whether personal data is being stored on a blockchain, with a focus on why blockchain is the preferred option for processing such information. Additionally, the board encourages a consideration of whether less permanent alternatives could do the trick.
A major issue the report tackles is data deletion. Being GDPR-friendly means erasing personal information once its purpose has been served or it's past its legally allowed retention period. This can be a real challenge with blockchain systems, as they're designed to be unchangeable.
EDPB puts it like this,
Quote:"Personal data needs to be deleted once it no longer serves its intended purpose and any regulatory periods for retention have expired, in order to stick to the principle of storage limitation."
Double Check:Data deletion in a blockchain can be tricky and may require tailor-made solutions. A complete overhaul of the blockchain could be necessary if erasure at an individual level isn't possible.
In response, the board advises examining the type of blockchain in play – public, private, or permissioned network – and experimenting with zero-knowledge architectures for privacy enhancement. Keeping data off-chain and implementing privacy-enhancing technologies could also help developers stay on the right side of GDPR.
Be warned, blockchain does not get a free pass under EU law. Developers and companies using this tech need to weigh the potential impact on data protection and consider how their technical and organizational measures align with GDPR requirements right from the get-go.
Heard a whisper?There's a question of consistency between GDPR's stance on data protection and MiCA's approach. Some wonder if the EU expects privacy on blockchain only when it benefits regulatory goals, or if double standards are kicking in.
Pssst! Stay tuned for the next chapter in this crypto-data mystery.
- The European Data Protection Board (EDPB) outlines a series of criteria for blockchain operators to consider when ensuring compliance with the General Data Protection Regulation (GDPR), specifically focusing on the immutable nature of blockchain data and the challenges it presents for data deletion as required by GDPR.
- To adhere to GDPR, personal data needs to be deleted once it no longer serves its intended purpose and any regulatory periods for retention have expired, even in the case of blockchain systems, but this can be a tricky issue and may necessitate tailor-made solutions.
- In light of GDPR's tightening regulations on data-and-cloud-computing technology, developers and companies using blockchain technology must carefully weigh the potential impact on data protection and consider implementing privacy-enhancing technologies such as zero-knowledge architectures or keeping data off-chain to align with GDPR requirements.
