7 ms·

GDPR vs. Blockchain: Technology vs. The Law

32 points by velmu 8y ago

DennisP 8y ago
Pretty reasonable actually: > GDPR does not prohibit blockchain, but it does put some procedural requirements around blockchain’s use in commercial enterprises. For individuals who opt into a blockchain, there is no authority to amend or correct a block once it is incorporated into the chain. For them, caveat emptor. For organizations, make sure you have a mechanism that will allow you to disassociate an individual with their blockchain contributions
- joering2 8y ago
  Wow the blockchain can actually become a grat loophole! Concerned about privacy of your users? Just upload their data to blockchain and then use this information anyway you want directly from the blockchain. I mean GDPR wont rollback blockchian, can they now?
  - knorker 8y ago
    IANAL, but pointers to PII are still PII. If you can go from "description or address" to "human" then it's PII.
    - Boulth 8y ago
      Yes. > Personal data that has been de-identified, encrypted or pseudonymised but can be used to re-identify a person remains personal data and falls within the scope of the law. Solution: > Personal data that has been rendered anonymous in such a way that the individual is not or no longer identifiable is no longer considered personal data. For data to be truly anonymised, the anonymisation must be irreversible. Source: https://ec.europa.eu/info/law/law-topic/data-protection/reform/what-personal-data_en https://ec.europa.eu/info/law/law-topic/data-protection/refo...
      - knorker 8y ago
        So you're agreeing? If someone else has the handle->PII mapping then the handle is PII too, and if you can't scrub the handle, then you are in violation of GDPR.
        DennisP 8y ago
        According to the article, you only have to scrub the actual PII, not the pointer to it. A pointer that points to nothing is fine, even if it used to point to PII. And even that is only the case if it's an enterprise holding the PII; if it's out there in the world in a P2P context then the law recognizes that nothing can be done about it.
        knorker 8y ago
        I'm not so sure. An IP address is PII, not because it's about you but because when combined with other databases identifies you. I'd argue that you're still identifiable if this pointer can be converted to your PII. Even if you point to someone elses database, as long as it's not been scrubbed. Again, IP address is PII even though I don't have address-to-human mappings. My understanding is that this is because their ISP does. Maybe somewhere the word "identifiable" is defined in the legal context? In any case we agree that whatever it means, it will not allow me to outsource PII-storage to China, and have mere random "handles" in their database, right? Because then the law is completely void through a loophole.
        DennisP 8y ago
        I think the scenario is, you have the PII in your database and the blockchain has "RecordNumber: 123", and then you delete all the PII in record 123 so the it's just a meaningless number. If there's another copy of the PII somewhere, then you haven't deleted it. If the PII was actually public on a P2P network, instead of held by a company, then they're saying the law doesn't apply.
        knorker 8y ago
SiempreViernes 8y ago
> A medical record would refer to “Corp-ID Client 192734.” If that person wished to be forgotten, the organization would re-assign that pseudo-ID to a null ID, eradicating the link from the person to the data. Putting medical records into a global public database seems like it would require a more anonymisation work than just redacting the name for it to be acceptable.
- fixermark 8y ago
  Also, the process described will require nothing to ever denormalize the record from the "handle" identifier to the "pointer" identifier. Caching is hard, so good luck guaranteeing that.
rwcarlsen 8y ago
Would the GDPR have any effect if an anonymous 3rd party installed personal info into the blockchain against the wishes of people who now want it to be forgotten?
- knorker 8y ago
  IANAL, but why would it matter how the PII got into some company's computers? GDPR demands that the person in question can have it removed. Otherwise companies could just go "yeah we have everyone's personal data, but that was done by a previous employee and we fired her, so we don't have to delete it".
  - rwcarlsen 8y ago
    But in the case of the (bitcoin or other public) blockchain - there is no person or organization you can go to to have it removed. It is a distributed p2p ledger/database with individuals and orgs all over the world in every jurisdiction storing and sharing the data.
    - knorker 8y ago
      Yes there is. - "Are you storing my data?" - "Uhm, technically… I mean it's on our hard drive" - "Delete all my data now. Please and thank you"
      - fixermark 8y ago
        "I'm in China, request denied."
        knorker 8y ago
        Sigh. 1) Sounds great! Hand over all bitcoin control to the Chinese jurisdiction. Problem solved, eh? 2) Hey CoinBase, Merchant X, etc… you are acting as a front to dealing in EU citizens PII, cease and desist with all that.
Klathmon 8y ago
My issue with Blockchain and "information laws" (not just GDPR, but any law which prohibits or controls information) is that you ("you" being the creator/maintainer of the blockchain) can never mess up. If someone puts "illegal information" directly in your blockchain, you either need a way to roll-back the change (which removes most/all of the benefits of an append-only structure like a blockchain), or you need to be okay with breaking the law. That someone could be a blackhat that wanted to publish a bunch of personal info, a disgruntled employee, or just regular users if you allow arbitrary input. I don't know of any kind of real solution, and at some point someone is going to push the limits and make it obvious that "illegal information" is on a blockchain, and we (as society) will have to come up with a way to deal with it.
- knorker 8y ago
  Would be better if someone could come up with a problem that blockchains solve.
  - petertodd 8y ago
    There's a good chance you're using a blockchain(1) to visit this website: the SSL certificate that protects your connection is published in a Certificate Transparency blockchain. If you're using Chrome, your browser verified a proof that the certificate was in fact in one of the CT blockchains. Being a blockchain, auditors (like the sysadmins at hacker news) can be sure they have the complete set of all certificates, and thus be sure they can detect any forgeries. 1) A blockchain is simply a chain of blocks. The key thing they do is allow auditing mechanisms to be sure they have the complete set of data contained in them. They're really a very simple and useful idea, which unfortunately has been hyped up by a bunch of scammers and semi-scammers. The consensus mechanisms used to secure blockchains are the interesting part, not the blockchains themselves. Although for many applications - Certificate Transparency being one of them - boring old trusted third parties seem to be good enough. That said, if you have a stronger decentralized chain available too, you can always publish commitments to the state of your centralized chain in the decentralized chain, improving security at relatively little cost. I wrote up a particularly scalable version of that idea here: https://petertodd.org/2017/scalable-single-use-seal-asset-transfer https://petertodd.org/2017/scalable-single-use-seal-asset-tr...
SCdF 8y ago
How is this specific to blockchains compared to any other kind of append-only book-keeping?
- Klathmon 8y ago
  Because blockchains have what most other append-only systems don't, a mathematical requirement that the data NEVER change in order for the system to continue running. In an append-only system the enforcement comes from the software running around the data, if you need to you can modify the data in the past, and tell the software to just pretend it wasn't changed. You can't do that with a blockchain without throwing the whole thing away, so it brings into question what happens when legally you MUST remove information.
  - petertodd 8y ago
    A good way to explain it is with a blockchain the math guarantees that you'll be able to detect modifications to the data, or if some data is missing, the potential of modifications. But even with a blockchain, the solution is the same: build an "escape hatch" into the validation software that allows certain kinds of data modifications and/or deletions to be ignored. The only difference is with a blockchain you'll have stronger guarantees that auditors will be able to detect if that has in fact happened. It is true that certain types of blockchain cryptographic structures can greatly limit the granularity of those options. But no-one actually uses those types of blockchains (namely chains without per-block merkle trees), so that point is moot.
jasode 8y ago
>Under GDPR, an organization that constructs a blockchain may have to remove a block or modify some data to comply with a request to forget someone.[...] GDPR does not prohibit blockchain, but it does put some procedural requirements around blockchain’s use in commercial enterprises. If "organizations" and "commercial enterprises" means entities like Goldman Sach's proposed blockchain, or Kodak's cryptocurrency, than the GDPR rules aren't really that radical nor create contradictions of compliance. As the blog says, just use a record id (a db "foreign key" id) instead of storing the raw data directly in the blockchain. The record pointer can either point to real data in a lookup table or point to null. The "erase" only works because the organization controls the "lookup table" that the record ids point to. Instead of that commercial scenario, what people wonder about are the public blockchains such as Bitcoin and Ethereum. Has there been definitive writing on that subject that concludes GDPR doesn't apply to those? Since there's no central authority in charge of those blockchains, any private data can't be erased as easily.
- knorker 8y ago
  IANAL: Bitcoin isn't cash[1] (or money?), so presumably doesn't have financial retention requirements. But it is data about my behaviour, purchase transactions, donations, interests, etc. Which is PII. Which means (to me) like I should be able to demand all transactions related to wallet xyz be purged, not just the "additional data" associated with the transactions. As we've learned anonymizing data is hard. Even with IP addresses removed people have been identified[2] [1] https://www.youtube.com/watch?v=p9HH_dFcoLc https://www.youtube.com/watch?v=p9HH_dFcoLc and other references and actual court decisions saying it's not money. [2] I think it's this one I'm thinking of: https://arstechnica.com/tech-policy/2009/09/your-secrets-live-online-in-databases-of-ruin/ https://arstechnica.com/tech-policy/2009/09/your-secrets-liv...
  - jasode 8y ago
    > I should be able to demand If GDPR applies to Bitcoin, _who_ would you demand the purge action from? There are an estimated ~10000 pseudoanonymous Bitcoin full nodes[1] all updating a ~170 GB append-only database[2]. Where does the GDPR compliance demand get sent? To the bitcoin user forum where some (not all) the developers hang out? Or to the maintainer of the github repo for C++ bitcoin client? What would be the procedure? Make those 10,000 nodes update and download new client software that "forks" the blockchain for each GDPR erasure request? Why would Chinese miners care about compliance with EU laws like GDPR? [1] https://bitnodes.earn.com/ https://bitnodes.earn.com/ [2] https://blockchain.info/charts/blocks-size https://blockchain.info/charts/blocks-size
kasperni 8y ago
If the information does not need to be public. A simple solution is to encrypt the data you put on the blockchain. And then just throw away the key if somebody request that you delete their information. Of course it cannot be applied in all situations. But sometimes it will do the trick.
- knorker 8y ago
  But an IP address is PII. So presumably a wallet address in PII. If so, then all transactions are PII and subject to GDPR removals. This seems harder to solve.
he0001 8y ago
With GDPR the scope of what is actual personal information is broadend. This means that an account number is considered personal information. How is any variant of an ID in a block chain different from an account id?
- Boulth 8y ago
  Account ID is only personal info if it can be tracked back to a person. Source: https://ec.europa.eu/info/law/law-topic/data-protection/reform/what-personal-data_en https://ec.europa.eu/info/law/law-topic/data-protection/refo...
  - he0001 8y ago
    As an example; If I have an account on a block chain I still will know what it is and anyone that have been interacting with that account could still identify the account. And GDPR says explicitly that it shouldn’t be possible at all to identify an individual given considering any amount of time and any resources. So I still think an “account” pseudo key in a block chain is still under GDPR. But we’ll probably see those cases in court under various conditions. Source: paragraph 26 http://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32016R0679&rid=1 http://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX...
vilhelm_s 8y ago
This applies to all uses Merkle trees---blockchains is one example, but someone[1] pointed out that git is another. Each git repo typically contains the names and email addresses of people who committed, and you can't rewrite history without disrupting anyone else who is working with the repo. Does this now mean that github is in violation of the GDPR, since they cannot retroactively delete people's personal information? [1] https://social.heldscal.la/notice/7460829 https://social.heldscal.la/notice/7460829
- knorker 8y ago
  > Each git repo typically contains the names and email addresses of people who committed, and you can't rewrite history without disrupting anyone else who is working with the repo. But you can do it. You can disrupt people, but shrug. You do the same thing in git to remove copyrighted content from your repo. You can't tell The Law (copyright law and/or GDPR) that "sorry, can't do it because that'd be inconvenient to people". The problem is that if you do it to bitcoin it breaks. > Does this now mean that github is in violation of the GDPR, since they cannot retroactively delete people's personal information? Sure they can. First of all github may not be the legal "owner" (I forget the term), the user is. Second, if github were told by a court to remove the content, of course they can. This is even scalable, to github: "Hello N. N. Due to GDPR request XYZ your repo A is in shallow-clone mode until you remove Y piece of PII. Click here to automatically git-filter-branch." To say they can't remove it is like saying you cannot remove PII because your business's domain name is TheresaMayIsABigFatTurd.com. That's not going to fly.

32 points by velmu 8y ago

Pretty reasonable actually: > GDPR does not prohibit blockchain, but it does put some procedural requirements around blockchain’s use in commercial enterprises. For individuals who opt into a blockchain, there is no authority to amend or correct a block once it is incorporated into the chain. For them, caveat emptor. For organizations, make sure you have a mechanism that will allow you to disassociate an individual with their blockchain contributions

joering2 8y ago
Wow the blockchain can actually become a grat loophole! Concerned about privacy of your users? Just upload their data to blockchain and then use this information anyway you want directly from the blockchain. I mean GDPR wont rollback blockchian, can they now?
- knorker 8y ago
  IANAL, but pointers to PII are still PII. If you can go from "description or address" to "human" then it's PII.
  - Boulth 8y ago
    Yes. > Personal data that has been de-identified, encrypted or pseudonymised but can be used to re-identify a person remains personal data and falls within the scope of the law. Solution: > Personal data that has been rendered anonymous in such a way that the individual is not or no longer identifiable is no longer considered personal data. For data to be truly anonymised, the anonymisation must be irreversible. Source: https://ec.europa.eu/info/law/law-topic/data-protection/reform/what-personal-data_en https://ec.europa.eu/info/law/law-topic/data-protection/refo...
    - knorker 8y ago
      So you're agreeing? If someone else has the handle->PII mapping then the handle is PII too, and if you can't scrub the handle, then you are in violation of GDPR.
      - DennisP 8y ago
        According to the article, you only have to scrub the actual PII, not the pointer to it. A pointer that points to nothing is fine, even if it used to point to PII. And even that is only the case if it's an enterprise holding the PII; if it's out there in the world in a P2P context then the law recognizes that nothing can be done about it.
        knorker 8y ago
        I'm not so sure. An IP address is PII, not because it's about you but because when combined with other databases identifies you. I'd argue that you're still identifiable if this pointer can be converted to your PII. Even if you point to someone elses database, as long as it's not been scrubbed. Again, IP address is PII even though I don't have address-to-human mappings. My understanding is that this is because their ISP does. Maybe somewhere the word "identifiable" is defined in the legal context? In any case we agree that whatever it means, it will not allow me to outsource PII-storage to China, and have mere random "handles" in their database, right? Because then the law is completely void through a loophole.
        DennisP 8y ago
        I think the scenario is, you have the PII in your database and the blockchain has "RecordNumber: 123", and then you delete all the PII in record 123 so the it's just a meaningless number. If there's another copy of the PII somewhere, then you haven't deleted it. If the PII was actually public on a P2P network, instead of held by a company, then they're saying the law doesn't apply.
        knorker 8y ago

SiempreViernes 8y ago

> A medical record would refer to “Corp-ID Client 192734.” If that person wished to be forgotten, the organization would re-assign that pseudo-ID to a null ID, eradicating the link from the person to the data. Putting medical records into a global public database seems like it would require a more anonymisation work than just redacting the name for it to be acceptable.

fixermark 8y ago
Also, the process described will require nothing to ever denormalize the record from the "handle" identifier to the "pointer" identifier. Caching is hard, so good luck guaranteeing that.

rwcarlsen 8y ago

Would the GDPR have any effect if an anonymous 3rd party installed personal info into the blockchain against the wishes of people who now want it to be forgotten?

knorker 8y ago
IANAL, but why would it matter how the PII got into some company's computers? GDPR demands that the person in question can have it removed. Otherwise companies could just go "yeah we have everyone's personal data, but that was done by a previous employee and we fired her, so we don't have to delete it".
- rwcarlsen 8y ago
  But in the case of the (bitcoin or other public) blockchain - there is no person or organization you can go to to have it removed. It is a distributed p2p ledger/database with individuals and orgs all over the world in every jurisdiction storing and sharing the data.
  - knorker 8y ago
    Yes there is. - "Are you storing my data?" - "Uhm, technically… I mean it's on our hard drive" - "Delete all my data now. Please and thank you"
    - fixermark 8y ago
      "I'm in China, request denied."
      - knorker 8y ago
        Sigh. 1) Sounds great! Hand over all bitcoin control to the Chinese jurisdiction. Problem solved, eh? 2) Hey CoinBase, Merchant X, etc… you are acting as a front to dealing in EU citizens PII, cease and desist with all that.

Klathmon 8y ago

My issue with Blockchain and "information laws" (not just GDPR, but any law which prohibits or controls information) is that you ("you" being the creator/maintainer of the blockchain) can never mess up. If someone puts "illegal information" directly in your blockchain, you either need a way to roll-back the change (which removes most/all of the benefits of an append-only structure like a blockchain), or you need to be okay with breaking the law. That someone could be a blackhat that wanted to publish a bunch of personal info, a disgruntled employee, or just regular users if you allow arbitrary input. I don't know of any kind of real solution, and at some point someone is going to push the limits and make it obvious that "illegal information" is on a blockchain, and we (as society) will have to come up with a way to deal with it.

knorker 8y ago
Would be better if someone could come up with a problem that blockchains solve.
- petertodd 8y ago
  There's a good chance you're using a blockchain(1) to visit this website: the SSL certificate that protects your connection is published in a Certificate Transparency blockchain. If you're using Chrome, your browser verified a proof that the certificate was in fact in one of the CT blockchains. Being a blockchain, auditors (like the sysadmins at hacker news) can be sure they have the complete set of all certificates, and thus be sure they can detect any forgeries. 1) A blockchain is simply a chain of blocks. The key thing they do is allow auditing mechanisms to be sure they have the complete set of data contained in them. They're really a very simple and useful idea, which unfortunately has been hyped up by a bunch of scammers and semi-scammers. The consensus mechanisms used to secure blockchains are the interesting part, not the blockchains themselves. Although for many applications - Certificate Transparency being one of them - boring old trusted third parties seem to be good enough. That said, if you have a stronger decentralized chain available too, you can always publish commitments to the state of your centralized chain in the decentralized chain, improving security at relatively little cost. I wrote up a particularly scalable version of that idea here: https://petertodd.org/2017/scalable-single-use-seal-asset-transfer https://petertodd.org/2017/scalable-single-use-seal-asset-tr...

SCdF 8y ago

How is this specific to blockchains compared to any other kind of append-only book-keeping?

Klathmon 8y ago
Because blockchains have what most other append-only systems don't, a mathematical requirement that the data NEVER change in order for the system to continue running. In an append-only system the enforcement comes from the software running around the data, if you need to you can modify the data in the past, and tell the software to just pretend it wasn't changed. You can't do that with a blockchain without throwing the whole thing away, so it brings into question what happens when legally you MUST remove information.
- petertodd 8y ago
  A good way to explain it is with a blockchain the math guarantees that you'll be able to detect modifications to the data, or if some data is missing, the potential of modifications. But even with a blockchain, the solution is the same: build an "escape hatch" into the validation software that allows certain kinds of data modifications and/or deletions to be ignored. The only difference is with a blockchain you'll have stronger guarantees that auditors will be able to detect if that has in fact happened. It is true that certain types of blockchain cryptographic structures can greatly limit the granularity of those options. But no-one actually uses those types of blockchains (namely chains without per-block merkle trees), so that point is moot.

jasode 8y ago

>Under GDPR, an organization that constructs a blockchain may have to remove a block or modify some data to comply with a request to forget someone.[...] GDPR does not prohibit blockchain, but it does put some procedural requirements around blockchain’s use in commercial enterprises. If "organizations" and "commercial enterprises" means entities like Goldman Sach's proposed blockchain, or Kodak's cryptocurrency, than the GDPR rules aren't really that radical nor create contradictions of compliance. As the blog says, just use a record id (a db "foreign key" id) instead of storing the raw data directly in the blockchain. The record pointer can either point to real data in a lookup table or point to null. The "erase" only works because the organization controls the "lookup table" that the record ids point to. Instead of that commercial scenario, what people wonder about are the public blockchains such as Bitcoin and Ethereum. Has there been definitive writing on that subject that concludes GDPR doesn't apply to those? Since there's no central authority in charge of those blockchains, any private data can't be erased as easily.

knorker 8y ago
IANAL: Bitcoin isn't cash[1] (or money?), so presumably doesn't have financial retention requirements. But it is data about my behaviour, purchase transactions, donations, interests, etc. Which is PII. Which means (to me) like I should be able to demand all transactions related to wallet xyz be purged, not just the "additional data" associated with the transactions. As we've learned anonymizing data is hard. Even with IP addresses removed people have been identified[2] [1] https://www.youtube.com/watch?v=p9HH_dFcoLc https://www.youtube.com/watch?v=p9HH_dFcoLc and other references and actual court decisions saying it's not money. [2] I think it's this one I'm thinking of: https://arstechnica.com/tech-policy/2009/09/your-secrets-live-online-in-databases-of-ruin/ https://arstechnica.com/tech-policy/2009/09/your-secrets-liv...
- jasode 8y ago
  > I should be able to demand If GDPR applies to Bitcoin, _who_ would you demand the purge action from? There are an estimated ~10000 pseudoanonymous Bitcoin full nodes[1] all updating a ~170 GB append-only database[2]. Where does the GDPR compliance demand get sent? To the bitcoin user forum where some (not all) the developers hang out? Or to the maintainer of the github repo for C++ bitcoin client? What would be the procedure? Make those 10,000 nodes update and download new client software that "forks" the blockchain for each GDPR erasure request? Why would Chinese miners care about compliance with EU laws like GDPR? [1] https://bitnodes.earn.com/ https://bitnodes.earn.com/ [2] https://blockchain.info/charts/blocks-size https://blockchain.info/charts/blocks-size

kasperni 8y ago

If the information does not need to be public. A simple solution is to encrypt the data you put on the blockchain. And then just throw away the key if somebody request that you delete their information. Of course it cannot be applied in all situations. But sometimes it will do the trick.

knorker 8y ago
But an IP address is PII. So presumably a wallet address in PII. If so, then all transactions are PII and subject to GDPR removals. This seems harder to solve.

he0001 8y ago

With GDPR the scope of what is actual personal information is broadend. This means that an account number is considered personal information. How is any variant of an ID in a block chain different from an account id?

Boulth 8y ago
Account ID is only personal info if it can be tracked back to a person. Source: https://ec.europa.eu/info/law/law-topic/data-protection/reform/what-personal-data_en https://ec.europa.eu/info/law/law-topic/data-protection/refo...
- he0001 8y ago
  As an example; If I have an account on a block chain I still will know what it is and anyone that have been interacting with that account could still identify the account. And GDPR says explicitly that it shouldn’t be possible at all to identify an individual given considering any amount of time and any resources. So I still think an “account” pseudo key in a block chain is still under GDPR. But we’ll probably see those cases in court under various conditions. Source: paragraph 26 http://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32016R0679&rid=1 http://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX...

vilhelm_s 8y ago

This applies to all uses Merkle trees---blockchains is one example, but someone[1] pointed out that git is another. Each git repo typically contains the names and email addresses of people who committed, and you can't rewrite history without disrupting anyone else who is working with the repo. Does this now mean that github is in violation of the GDPR, since they cannot retroactively delete people's personal information? [1] https://social.heldscal.la/notice/7460829 https://social.heldscal.la/notice/7460829

knorker 8y ago
> Each git repo typically contains the names and email addresses of people who committed, and you can't rewrite history without disrupting anyone else who is working with the repo. But you can do it. You can disrupt people, but shrug. You do the same thing in git to remove copyrighted content from your repo. You can't tell The Law (copyright law and/or GDPR) that "sorry, can't do it because that'd be inconvenient to people". The problem is that if you do it to bitcoin it breaks. > Does this now mean that github is in violation of the GDPR, since they cannot retroactively delete people's personal information? Sure they can. First of all github may not be the legal "owner" (I forget the term), the user is. Second, if github were told by a court to remove the content, of course they can. This is even scalable, to github: "Hello N. N. Due to GDPR request XYZ your repo A is in shallow-clone mode until you remove Y piece of PII. Click here to automatically git-filter-branch." To say they can't remove it is like saying you cannot remove PII because your business's domain name is TheresaMayIsABigFatTurd.com. That's not going to fly.