5 ms·

Makes me wonder about block chain data that can't be deleted

by _betty_ 9y ago

TeMPOraL 9y ago
If you put PII on the blockchain then God have mercy on your soul when the regulators find out...
- repsilat 9y ago
  Can a malicious actor put PII (or copyrighted/otherwise illegal works) onto a blockchain to "kill" it?
  - _betty_ 9y ago
    There's apparently all sorts of illegal stuff embedded in bitcoin metadata
    - SuddsMcDuff 9y ago
      An uncensorable, global, distributed data store opens up all kinds of possibilities for weaponizing data. If you're intending to blackmail* someone by threat of doxxing, threatening to put their information on the blockchain is much worse than simply putting it on pastebin. People have also attempted to use blockchain data for coercion. For example some folks were worried about the centralization of Bitcoin mining in China, so they posted information about Tiananmen Square on the blockchain, hoping the Chinese government would simply ban Bitcoin. *blockmailing them, if you will.
PeterisP 9y ago
That's quite simple - as a controller holding my data, you're responsible for safeguarding the data and fulfilling the requirements, so if putting that data on a public blockchain makes it impossible to do your duty, then you're not allowed to put that data on a public blockchain. If I put my data there, that's my problem, but you're not allowed to do that.
- LoSboccacc 9y ago
  > If I put my data there, that's my problem, but you're not allowed to do that. is it really? that's a part I did not really understand about the regulation and can't find anything about voluntarily relinquishing control of personal data. i.e: I leave my personal name and email address on a public forum. Google later add that post to it's index, or another random company like Web Archive or archive.is scrapes it. What are my rights? What are their obligations? is the forum owner liable for my action if I didn't explicitly agree for my data to be shared by him to all unforeseeable future scrapers? > as a controller holding my data, you're responsible for safeguarding the data this confuses me even more. say I'm running an analytic system. I track users trough a cookie. tracking cookies are, for some reason, personal information. if an user delete the cookie from their browser and then ask to fulfill my obligations about erasing his data from my system, how do I identify him? who's liable then?
  - wsy 9y ago
    The last part of your question is easy to answer. Before you start processing personal information, you need to ask the affected persons for consent. So now you know how to identify them. If you want to get away without consent, you need to design your system in such a way that it doesn't hold personal information. E.g., maybe randomize the raw tracking data as first processing step, and only keep the randomized version.
  - WA 9y ago
    > I leave my personal name and email address on a public forum. Google later add that post to it's index, or another random company like Web Archive or archive.is scrapes it. I wish there was an official guide on how to run a forum properly, because all forums suffer from the same problems. What I figured out so far: You as a forum administrator must delete that personal data on request. This could mean digging through all posts of a user and delete all PII, although you don’t have to delete all posts if they contain no PII. You as a forum administrator must get your privacy policy right and possibly make it harder for third parties to index PII. This depends on your intentions and whether or not people know that your forum is public. Say, your forum is about car parts. You could set a subforum that asks members to introduce themselves (where PII are most likely) to noindex or hide from the public. This way, you’ve put in reasonable effort to protect your users and your obligation is done. Indexing by third parties is now out of your control. But say you run a medical forum where people post health data (considered super sensitive) and are expected to post a lot of PII, you might have to set the entire board to ”members only“. Although I’m not sure about any of this and to some extend, most forums provide value by being visible to visitors and indexes by Google. Quite sad.
Freak_NL 9y ago
The general approach for using a blockchain with personally identifiable information seems to be storing only that something happened, not exactly what. Effectively, this means storing only a resource-local identifier, some metadata (e.g., 'UPDATED RECORD'), and a reference to the database were the actual data is stored on the blockchain.

Makes me wonder about block chain data that can't be deleted

TeMPOraL 9y ago

If you put PII on the blockchain then God have mercy on your soul when the regulators find out...

repsilat 9y ago
Can a malicious actor put PII (or copyrighted/otherwise illegal works) onto a blockchain to "kill" it?
- _betty_ 9y ago
  There's apparently all sorts of illegal stuff embedded in bitcoin metadata
  - SuddsMcDuff 9y ago
    An uncensorable, global, distributed data store opens up all kinds of possibilities for weaponizing data. If you're intending to blackmail* someone by threat of doxxing, threatening to put their information on the blockchain is much worse than simply putting it on pastebin. People have also attempted to use blockchain data for coercion. For example some folks were worried about the centralization of Bitcoin mining in China, so they posted information about Tiananmen Square on the blockchain, hoping the Chinese government would simply ban Bitcoin. *blockmailing them, if you will.

PeterisP 9y ago

That's quite simple - as a controller holding my data, you're responsible for safeguarding the data and fulfilling the requirements, so if putting that data on a public blockchain makes it impossible to do your duty, then you're not allowed to put that data on a public blockchain. If I put my data there, that's my problem, but you're not allowed to do that.

LoSboccacc 9y ago
> If I put my data there, that's my problem, but you're not allowed to do that. is it really? that's a part I did not really understand about the regulation and can't find anything about voluntarily relinquishing control of personal data. i.e: I leave my personal name and email address on a public forum. Google later add that post to it's index, or another random company like Web Archive or archive.is scrapes it. What are my rights? What are their obligations? is the forum owner liable for my action if I didn't explicitly agree for my data to be shared by him to all unforeseeable future scrapers? > as a controller holding my data, you're responsible for safeguarding the data this confuses me even more. say I'm running an analytic system. I track users trough a cookie. tracking cookies are, for some reason, personal information. if an user delete the cookie from their browser and then ask to fulfill my obligations about erasing his data from my system, how do I identify him? who's liable then?
- wsy 9y ago
  The last part of your question is easy to answer. Before you start processing personal information, you need to ask the affected persons for consent. So now you know how to identify them. If you want to get away without consent, you need to design your system in such a way that it doesn't hold personal information. E.g., maybe randomize the raw tracking data as first processing step, and only keep the randomized version.
- WA 9y ago
  > I leave my personal name and email address on a public forum. Google later add that post to it's index, or another random company like Web Archive or archive.is scrapes it. I wish there was an official guide on how to run a forum properly, because all forums suffer from the same problems. What I figured out so far: You as a forum administrator must delete that personal data on request. This could mean digging through all posts of a user and delete all PII, although you don’t have to delete all posts if they contain no PII. You as a forum administrator must get your privacy policy right and possibly make it harder for third parties to index PII. This depends on your intentions and whether or not people know that your forum is public. Say, your forum is about car parts. You could set a subforum that asks members to introduce themselves (where PII are most likely) to noindex or hide from the public. This way, you’ve put in reasonable effort to protect your users and your obligation is done. Indexing by third parties is now out of your control. But say you run a medical forum where people post health data (considered super sensitive) and are expected to post a lot of PII, you might have to set the entire board to ”members only“. Although I’m not sure about any of this and to some extend, most forums provide value by being visible to visitors and indexes by Google. Quite sad.

Freak_NL 9y ago

The general approach for using a blockchain with personally identifiable information seems to be storing only that something happened, not exactly what. Effectively, this means storing only a resource-local identifier, some metadata (e.g., 'UPDATED RECORD'), and a reference to the database were the actual data is stored on the blockchain.