3 ms·
> Recitations in GDPR require systems to be designed with privacy in mind. Immutable structures like the Bitcoin blockchain or Merkle trees in other application
by ckastner 9y ago
> Recitations in GDPR require systems to be designed with privacy in mind. Immutable structures like the Bitcoin blockchain or Merkle trees in other applications would seem to be fundamentally incompatible with some GDPR privacy requirements.
And against whom would I claim my rights, for example: my right to be forgotten (Article 17: The data subject
shall have the right to obtain from the controller the erasure of personal data concerning him or her without
undue delay [...])?
In the case of a distributed blockchain, who is the controller as defined by the GDPR?
And even if one could identify a controller (say, in the case of a blockchain under centralized control), there are still exceptions to the rights of data subjects. Privacy is key to the GDPR, but not an absolute.
- pjc50 9y agoEvery person running a full node would theoretically be a controller in that case. But as you say, you could probably make a "business requirements" case if it's just a certificate. Right to be forgotten does not include the right to demand people forget that you owe them money, for example. What gets more complex is if you put non-business-related "sensitive" personal data in an immutable system, e.g. if you're building an illegal blacklist of union organisers.