Blockchains inherently process personal data across borders in an immutable manner, but some data processing is necessary for their functioning. To comply with the GDPR's data protection by design and default requirements, blockchains can implement measures like encrypting or hashing personal data stored on distributed ledgers. However, while crypto communities emphasize encryption and avoiding re-identification, other data protection principles like user control, privacy, and rights must also be respected. Governance and standards are needed to help blockchains fully implement data protection by design.

1. {
Data protection by
design and by default
on the blockchain
TILTing2019 - 17 May 2019
Alexandra Giannopoulou
Blockchain and Society Policy Lab
Institute for Information Law (IViR)
University of Amsterdam

2.  Immutability of the blockchain
 Transnational processing
 Some personal data processing is
essential for the functioning of
blockchains
Dessine-moi une blockchain…

3. Blocks containing transactions
 Metadata
 Encrypted personal data
 Hashed personal data
What do we store on the
distributed ledger?

4. Article 25 GDPR Data protection by design and by default
1. Taking into account the state of the art, the cost of implementation and the nature,
scope, context and purposes of processing as well as the risks of varying likelihood
and severity for rights and freedoms of natural persons posed by the processing, the
controller shall, both at the time of the determination of the means for processing
and at the time of the processing itself, implement appropriate technical and
organisational measures, such as pseudonymisation, which are designed to
implement data-protection principles, such as data minimisation, in an effective
manner and to integrate the necessary safeguards into the processing in order to
meet the requirements of this Regulation and protect the rights of data subjects.
1. The controller shall implement appropriate technical and organisational measures
for ensuring that, by default, only personal data which are necessary for each
specific purpose of the processing are processed. That obligation applies to the
amount of personal data collected, the extent of their processing, the period of their
storage and their accessibility. In particular, such measures shall ensure that by
default personal data are not made accessible without the individual's intervention
to an indefinite number of natural persons.

5. Not at odds conceptually because …
Blockchains and DPbD
Asymmetric encryption is a basic component and essential feature of
blockchains, contributing to giving the technology the value it has today

6. • Where does this awareness stem from?
However…

7. • Where does this awareness stem from?
However…
Crypto (as in encryption not in currency) communities imp

8. • Where does this awareness stem from?
The inherent goal of the PETs is to avoid re-identification of
parties and transactions
However…
Crypto (as in encryption not in currency) communities imp

9. • Where does this awareness stem from?
The inherent goal of the PETs is to avoid re-identification of
parties and transactions
• What about other features of data protection by design?
However…
Crypto (as in encryption not in currency) communities imp
But…

10. Escape the surveillance machine!

11. Escape the surveillance machine!
Trust the technology’s features but what about user control?

12. Escape the surveillance machine!
Trust the technology’s features but what about user control?
Respect for data protection
principles
Respect for data
subjects’ rights

13.  Privacy-enhancing technologies emerging on
the blockchain
Zero-knowledge proof
Ring signatures
Taproot “scriptless scripts”
 Which design features? Which standards?
Governance!
Technology to the rescue!

14.  Waiting on blockchain case law to form
guidelines and interpretations?
 How about liability?
Is there a conciliation
point in sight?

15. a.giannopoulou@uva.nl @alex_giann