10 Sep The Legal reserve between Blockchain Technology and GDPR in the context of InEExS project
Verdia Legal is an active part of the LIFE InEExS project, Innovative Energy (Efficiency) Service Models for Sector Integration via Blockchain. The core concept of the LIFE project InEExS is the deployment of integrated energy services across sectors and carriers, and the tokenization of energy saving data in a public blockchain to facilitate cooperation among market segments and actors. At Verdia Legal, our role is to provide specialized legal advice across various stages of the project.
The emergence of distributed accounting technologies, such as the blockchain, has raised new challenges in aligning the use of personal data with the rights and obligations established by the General Data Protection Regulation (GDPR). In this context, we have addressed some legal issues and challenges that arise when integrating blockchain technology with the GDPR, proposing alternatives and solutions to ensure compliance.
1. Personal Data and Pseudonymisation
The definition of personal data determines the GDPR’s scope of application and is accordingly of paramount importance, since the Regulation only applies to data that is considered ‘personal’ in nature.
Article 4 (1) GDPR underlines that personal data is data that directly or indirectly relates to an identified or identifiable natural person. The reference to an ‘identifiable’ person underlines that the data subject does not need to be already identified for data to qualify as personal data. As it would be explained further on, the mere possibility of identification is sufficient.
Defining the boundary between personal and non-personal data is filled with uncertainty because of the wide range of personal data and the technical ability to deduce information about individuals from seemingly unrelated data points.
Article 4(5) GDPR introduces pseudonymisation as the “processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures to ensure that the personal data are not attributed to an identified or identifiable natural person.”
The GDPR text recognizes that pseudonymization is a valuable approach to minimize risks. However, it should not be regarded as an anonymization technique. It is important to understand that the legal concept of pseudonymization does not align with its common-sense interpretation. From a legal standpoint, pseudonymous data is always considered personal data. This raises the question of whether pseudonymization measures, as understood in computer science, can actually generate anonymous data.
1.1. Transforming personal data into anonymous data
There is currently ample uncertainty as to when the line between personal and non-personal data is crossed in practice. The principle that should be used to determine whether data is personal data or not is that of the reasonable likelihood of identification, which is enshrined in Recital 26 GDPR. In addition, the GDPR’s preamble furthermore provides a list of elements to be taken into account to determine the likelihood of identifiability through all the means reasonably likely to be used. These include “all objective factors, such as the costs of and the amount of time required for identification, taking into consideration the available technology at the time of the processing and technological developments”.
1.2.The criteria of identifiability
According to Article 29 Working Party, three different criteria ought to be considered to determine whether de-identification is ‘irreversible’ or ‘as permanent as erasure’ namely whether:
- Singling out: possibility to isolate some or all records which identify an individual in the dataset’.
- Linkability: possibility to relate information from different datasets about the same individual.
- Inference: it has been defined by the Working Group as “the possibility to deduce, with significant probability, the value of an attribute from the values of a set of other attributes”.
Transforming personal data in a manner that excludes singling out, linkability and inference in a reasonable manner is difficult. This is confirmed by the Working Party’s analysis of the most commonly used ‘anonymisation’ methods, which lead it to conclude that each of them leaves a residual risk of identification so that, if at all, only a combination of different approaches can depersonalise data.
In terms of Blockchain, the EU considers that pseudonymous data on a blockchain can, in principle, be related to an identified or identifiable natural personal through singling out, inference or linkability. This means that pseudonymisation of personal data is not considered anonymous, and therefore, they fall within the objective scope of the GDPR. However, it should not be forgotten that anonymised data, on the contrary, are not subject to the application of the GDPR, therefore any anonymisation will fall outside the scope of the GDPR.
2. Data Subject Rights
The General Data Protection Regulation establishes the following rights:
- Right to access (article 15 GDPR): It allows data subjects to obtain confirmation as to whether their personal data are being processed, and access to them, as well as access to information on the purpose of the processing, categories of data, recipients, storage period, rights of rectification or erasure, and details of automated decisions.
- Right to rectification (art. 16 GDPR): Data subjects shall have the right to obtain the rectification of inaccurate personal data and the completion of incomplete personal data.
- Right to restriction of processing (art. 18 GDPR): It allows data subjects to limit the processing of their personal data in certain circumstances.
- Right to data portability (art. 20 GDPR): it allows data subjects to transfer their data from one controller to another in a structured and machine-readable format.
- Right to object (art. 21 GDPR): It allows data subjects to object to the processing of their personal data where it is based on public or legitimate interests, unless the data controller can demonstrate “compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims”.
- Right to erasure – Right to be forgotten (art. 17 GDPR): It allows data subjects to request the erasure of their personal data under certain conditions, such as when the data are no longer needed, consent is withdrawn, they object to the processing without overriding legitimate grounds, the data were processed unlawfully, they must be deleted in order to comply with a legal obligation, or they were collected in connection with information society services.
2.1. The meaning of erasure
According to Art. 29 Working Party on the Opinion 05/2012, national and supranational regulators have moreover indicated that there may be alternatives to the outright destruction of data that could secure compliance with the GDPR’s erasure obligation, such as the destruction of hardware[1].
Furthermore, national data protection authorities have considered that erasure does not necessarily equal destruction. For example, the Austrian Data Protection Authority recognised in a legally binding decision that the data controller enjoys flexibility regarding the technical means of realising erasure, and that anonymisation can be seen as a means to realise erasure[2]. In particular, the Austrian Data Protection Authority stated that the removal of the personal reference (“Anonymisation”) of personal data can therefore in principle be a possible means for deletion within the meaning of article 4(2) in conjunction with Article 17(1) GDPR. However, it maintains that neither the controller itself nor a third party can re-establish a personal reference without disproportionate effort.
2.2. Possible alternative technical means of achieving erasure on DLTs
As awareness regarding the tricky reconciliation between Article 17 GDPR and distributed ledgers grows, a number of technical alternatives to the outright destruction of data have been considered by various actors. An often-mentioned solution is that of the destruction of the private key, which would have the effect of making data encrypted with a public key inaccessible. This is indeed the solution that has been put forward by the French data protection authority CNIL in its guidance on blockchains and the GDPR. The CNIL has suggested that erasure could be obtained where the keyed hash function’s secret key is deleted together with information from other systems where it was stored for processing[3].
Other possible alternative technical means of achieving erasure on blockchains have been suggested. In this case, and depending on the specific blockchain use case, it may not be necessary to store all transactional data on the blockchain itself. Rather, such data could be stored in another off-chain database and merely linked to the distributed ledger through a hash, a process which, has been considered, would have a number of advantages from a data protection perspective.[4]
Where data is found to classify as personal data, it should, where possible, be kept off-chain and merely linked to the ledger through a hash-pointer. Whereas this does not change its nature as personal data, it makes it easier to comply with GDPR requirements. Commentators have indeed recommended that the DLT transaction itself would ‘only contain information needed to access the personal data in the separate database. In this manner, it would be possible to confine personal data to the off-chain storage and avoid storing such data on the blockchain’.[5]
It is important to note that whereas it will often be possible to store transactional data off-chain, this is not the case for public keys. Off-chain storage would enable the rectification and erasure of personal data stored off-chain in appropriate databases in light with Articles 16 and 17 GDPR.[6] If data needs to be erased, the records in the database can be deleted, essentially leaving the immutable hash on the blockchain referencing a non-existent file.
[1] Article 29, Working Party, Opinion 05/2012 on Cloud Computing (01037/12/EN WP 196).
[2] Austrian Data Protection Authority, DSB-D123.270/0009-DSB/2018 (05 December 2018).
[3] Commission Nationale Informatique et Libertés (Séptembre,2018), Prémiers Éléments d’analyse de la Blockchain: sets that:
“When a cryptographic commitment is perfectly indistinguishable (“perfectly hiding”), the removal of the witness and the committed value is sufficient to anonymise the commitment so that it loses its qualification as personal data.”
[4] Blockchain and the General Data Protection Regulation. Can distributed ledgers be squared with European data protection law? European Parliamentary Research Service. July 2019
[5] Bacon J et al (2018), ‘Blockchain Demystified: A Technical and Legal Introduction to Distributed and Centralised Ledgers’ Richmond Journal of Law and Technology
[6] Berberich M and Steiner M (2016), ‘Blockchain technology and the GDPR – How to Reconcile Privacy and Distributed Ledgers?’ 2 European Data Protection Law Review 422, 425