Blockchain and GDPR Blockchain Hands On, March 5 th 2019, Fusion, - - PowerPoint PPT Presentation

▶
blockchain and gdpr
SMART_READER_LITE
LIVE PREVIEW

Blockchain and GDPR Blockchain Hands On, March 5 th 2019, Fusion, - - PowerPoint PPT Presentation

May 22, 2023 205 likes •641 views

Blockchain and GDPR Blockchain Hands On, March 5 th 2019, Fusion, Geneva Jrn Erbguth, Dipl.-Inf., Dipl.-Jur. Consultant Legal Tech, Blockchain, Smart Contracts and Data Protection PhD candidate, University of Geneva joern@erbguth.ch +41

slide-1
SLIDE 1

Blockchain and GDPR

Blockchain Hands On, March 5th 2019, Fusion, Geneva Jörn Erbguth, Dipl.-Inf., Dipl.-Jur. Consultant Legal Tech, Blockchain, Smart Contracts and Data Protection PhD candidate, University of Geneva joern@erbguth.ch +41 787256027

slide-2
SLIDE 2

Blockc kchain an and GD GDPR March 5, 2019 Blockchain Hands On, Geneva Jörn Erbguth, joern@erbguth.ch #2

GDPR vs. Blockchain

GDPR Blockchain

Ri Right t to to …

  • Art. 16: rectification
  • Art. 17: erasure
  • Art. 18: restriction of processing

immutable public

slide-3
SLIDE 3

Blockc kchain an and GD GDPR March 5, 2019 Blockchain Hands On, Geneva Jörn Erbguth, joern@erbguth.ch #3

GDPR vs. Blockchain

GDPR Blockchain

Cl Clear r resp sponsi sibilities controller processor distributed responsibility anonymous participation

slide-4
SLIDE 4

Blockc kchain an and GD GDPR March 5, 2019 Blockchain Hands On, Geneva Jörn Erbguth, joern@erbguth.ch #4

Agenda

  • GDPR
  • How to evaluate GDPR compliance
  • How to use hashing correctly
  • Public and permissioned blockchains
  • 5 ways for blockchain applications to cope with GDPR
slide-5
SLIDE 5

Blockc kchain an and GD GDPR March 5, 2019 Blockchain Hands On, Geneva Jörn Erbguth, joern@erbguth.ch #5

Charter of Fundamental Rights of the European Union

slide-6
SLIDE 6

Blockc kchain an and GD GDPR March 5, 2019 Blockchain Hands On, Geneva Jörn Erbguth, joern@erbguth.ch #6

What does the GDPR protect?

slide-7
SLIDE 7

Blockc kchain an and GD GDPR March 5, 2019 Blockchain Hands On, Geneva Jörn Erbguth, joern@erbguth.ch #7

GDPR in Relation to Other Fundamental Rights

slide-8
SLIDE 8

Blockc kchain an and GD GDPR March 5, 2019 Blockchain Hands On, Geneva Jörn Erbguth, joern@erbguth.ch #8

General Data Protection Regulation (GDPR)

  • Processing of personal data is forbidden
  • Unless there is proper justification
  • Obligations for controllers and processors
  • Rights for data subjects
  • Includes obligation to information security
  • Fines up to 20 mill. € or 4% of worldwide annual turnover
slide-9
SLIDE 9

Blockc kchain an and GD GDPR March 5, 2019 Blockchain Hands On, Geneva Jörn Erbguth, joern@erbguth.ch #9

How to evaluate GDPR compliance

  • Does GDPR apply?
  • Is there processing of personal data?
  • Is there a justification for this data processing?
  • Do I comply with the obligations of GDPR?
slide-10
SLIDE 10

Blockc kchain an and GD GDPR March 5, 2019 Blockchain Hands On, Geneva Jörn Erbguth, joern@erbguth.ch #10

Does the GDPR apply? (Art. 2, 3)

  • Some entity that is considered a controller or a processor

is in the EU

  • Offering goods or services to data subjects in the EU
  • Monitoring behavior of data subjects in the EU
  • Not if only for personal use or household activity
slide-11
SLIDE 11

Blockc kchain an and GD GDPR March 5, 2019 Blockchain Hands On, Geneva Jörn Erbguth, joern@erbguth.ch #11

Personal data (Art. 4.1)?

Any information relating to an identified or identifiable natural person

  • Pseudonymous data is personal data
  • Anonymous data is not

not personal data

Recital 26: To determine whether a natural person is identifiable, account should be taken

  • f all the means reasonably like

kely to be used ... either by the controller or by another person to identify the natural person directly or indirectly.

slide-12
SLIDE 12

Blockc kchain an and GD GDPR March 5, 2019 Blockchain Hands On, Geneva Jörn Erbguth, joern@erbguth.ch #12

Examples of personal data

ü IP addresses ü Bitcoin addresses ü “anonymized” movement profile ü “anonymized” browsing history ✗ aggregated movement profiles ✗ aggregated browsing history

Attention: Look k at the individual case – do do n not g generalize

slide-13
SLIDE 13

Blockc kchain an and GD GDPR March 5, 2019 Blockchain Hands On, Geneva Jörn Erbguth, joern@erbguth.ch #13

Encryption

Deletion of the encryption key = deletion of the content?

slide-14
SLIDE 14

Blockc kchain an and GD GDPR March 5, 2019 Blockchain Hands On, Geneva Jörn Erbguth, joern@erbguth.ch #14

slide-15
SLIDE 15

Blockc kchain an and GD GDPR March 5, 2019 Blockchain Hands On, Geneva Jörn Erbguth, joern@erbguth.ch #15

GDPR-compliant deletion?

  • Deletion of the encryption key = deletion of the content?
  • Is there a remaining copy of the key?
  • Will the encryption method become insecure in the future?
slide-16
SLIDE 16

Blockc kchain an and GD GDPR March 5, 2019 Blockchain Hands On, Geneva Jörn Erbguth, joern@erbguth.ch #16

Use of Hash Values

Pu Public lic Priva Private

Encrypted Data

slide-17
SLIDE 17

Blockc kchain an and GD GDPR March 5, 2019 Blockchain Hands On, Geneva Jörn Erbguth, joern@erbguth.ch #17

Use of Hash Values

Pu Public lic Priva Private

Data

slide-18
SLIDE 18

Blockc kchain an and GD GDPR March 5, 2019 Blockchain Hands On, Geneva Jörn Erbguth, joern@erbguth.ch #18

Cryptographic hash functions

  • Serve as digital fingerprints
  • Virtually unique
  • Fixed length (e.g. 32 bytes)
  • For digital objects of any size
  • One-way function

Demo 2

slide-19
SLIDE 19

Blockc kchain an and GD GDPR March 5, 2019 Blockchain Hands On, Geneva Jörn Erbguth, joern@erbguth.ch #19

Kryptografische Hashwerte, datenschutzkonform

slide-20
SLIDE 20

Blockc kchain an and GD GDPR March 5, 2019 Blockchain Hands On, Geneva Jörn Erbguth, joern@erbguth.ch #20

Kryptografische Hashwerte, nicht datenschutzkonform

hat Diplom

slide-21
SLIDE 21

Blockc kchain an and GD GDPR March 5, 2019 Blockchain Hands On, Geneva Jörn Erbguth, joern@erbguth.ch #21

Use Cases for Cryptographic Hash Functions

  • Validate external documents
  • Time-stamping
  • Proof of Existence
  • Basic functionality for cryptography and DLT

Th The w wron

  • ng u

g use of

  • f h

hash f function

  • ns c

can l lead t to t

  • the

ide identif tific icatio tion of da data ta subje bjects ts!

slide-22
SLIDE 22

Blockc kchain an and GD GDPR March 5, 2019 Blockchain Hands On, Geneva Jörn Erbguth, joern@erbguth.ch #22

Adding Salt and Pepper to Hashes

  • Ensuring enough en

entropy

  • Making guessing really hard
  • Can prevent rainbow table attacks
  • Can prevent parallel attacks
slide-23
SLIDE 23

Blockc kchain an and GD GDPR March 5, 2019 Blockchain Hands On, Geneva Jörn Erbguth, joern@erbguth.ch #23

How to Hash Data

slide-24
SLIDE 24

Blockc kchain an and GD GDPR March 5, 2019 Blockchain Hands On, Geneva Jörn Erbguth, joern@erbguth.ch #24

How to Hash Data

slide-25
SLIDE 25

Blockc kchain an and GD GDPR March 5, 2019 Blockchain Hands On, Geneva Jörn Erbguth, joern@erbguth.ch #25

How to Hash Data

slide-26
SLIDE 26

Blockc kchain an and GD GDPR March 5, 2019 Blockchain Hands On, Geneva Jörn Erbguth, joern@erbguth.ch #26

How to Hash Data

slide-27
SLIDE 27

Blockc kchain an and GD GDPR March 5, 2019 Blockchain Hands On, Geneva Jörn Erbguth, joern@erbguth.ch #27

Test: Does the Blockchain Leak Personal Data?

Does the system disclose personal data by itself? What if

  • somebody knows one transaction, can she see further

transactions of the same person?

  • somebody knows part of a transaction, can she see

further details?

  • somebody knows personal details of a person, can she

discover information about the person’s activity?

slide-28
SLIDE 28

Blockc kchain an and GD GDPR March 5, 2019 Blockchain Hands On, Geneva Jörn Erbguth, joern@erbguth.ch #28

Zero-Knowledge Proof

Proof of knowing something without revealing it

slide-29
SLIDE 29

Blockc kchain an and GD GDPR March 5, 2019 Blockchain Hands On, Geneva Jörn Erbguth, joern@erbguth.ch #29

Zero-Knowledge Proof – Zcash

  • Limiting the purpose of using personal data by technical means
  • Only the correctness of the transaction can be proven
  • Privacy by design
slide-30
SLIDE 30

Blockc kchain an and GD GDPR March 5, 2019 Blockchain Hands On, Geneva Jörn Erbguth, joern@erbguth.ch #30

Advantages

  • Protection also against insiders (e.g. admins)
  • Access rights cannot be modified retroactively
  • Protection against intruders that breach the firewall
  • Data is protected against manipulation
slide-31
SLIDE 31

Blockc kchain an and GD GDPR March 5, 2019 Blockchain Hands On, Geneva Jörn Erbguth, joern@erbguth.ch #31

Still personal data?

  • In a pre-GDPR opinion, DPAs said yes (Art. 29 WP, 05/14)
  • GDPR says, it depends
  • So does the Austrian Datenschutzbehörde
  • Risk that immutable data on blockchains become personal

data later

slide-32
SLIDE 32

Blockc kchain an and GD GDPR March 5, 2019 Blockchain Hands On, Geneva Jörn Erbguth, joern@erbguth.ch #32

Opinion of the CNIL

Order of Preference

  • Zero-Knowledge Proof
  • Hashes with secret key (peppered hashes)
  • Encryption
  • Hashes without additional secret key
  • Clear text
slide-33
SLIDE 33

Blockc kchain an and GD GDPR March 5, 2019 Blockchain Hands On, Geneva Jörn Erbguth, joern@erbguth.ch #33

Lawfulness of processing (Art. 6)

  • Consent (Art. 6.1 a)
  • Performance of a contract (Art. 6.1 b)
  • Compliance with a legal obligation (Art. 6.1 c)
  • Legitimate interest (Art. 6.1 f)
slide-34
SLIDE 34

Blockc kchain an and GD GDPR March 5, 2019 Blockchain Hands On, Geneva Jörn Erbguth, joern@erbguth.ch #34

Controllers, Processors, Data Subjects

Controller Processor

Determines the purposes and means of processing Processes data

  • n behalf of the controller

Data-Subjects

slide-35
SLIDE 35

Blockc kchain an and GD GDPR March 5, 2019 Blockchain Hands On, Geneva Jörn Erbguth, joern@erbguth.ch #35

Controllers, Processors, Data Subjects

Controller

Determines the purposes and means of processing

Data-Subjects Joint-

slide-36
SLIDE 36

Blockc kchain an and GD GDPR March 5, 2019 Blockchain Hands On, Geneva Jörn Erbguth, joern@erbguth.ch #36

Who is “Controller” and who is “Processor”?

  • Node operators?
  • Miner who mines a specific block?
  • All miners together?
  • User who signs a transaction with her private key?
  • Exchange or wallet service that signs a transaction on behalf
  • f a user?
  • Entity that administrates permissions for a permissioned

blockchain?

slide-37
SLIDE 37

Blockc kchain an and GD GDPR March 5, 2019 Blockchain Hands On, Geneva Jörn Erbguth, joern@erbguth.ch #37

Opinion of the CNIL on Controllers and Processors

  • User of a public blockchain is a controller
  • Somebody who creates and controls a permissioned

blockchain is a controller

  • Members of a consortium can be joint controllers
  • Node operators are processors
  • Smart contract developers can be processors,

if they retain control

slide-38
SLIDE 38

Blockc kchain an and GD GDPR March 5, 2019 Blockchain Hands On, Geneva Jörn Erbguth, joern@erbguth.ch #38

Duties of Controllers and Processors

  • Controllers must identify themselves
  • Controllers are responsible towards data subjects
  • Controllers must have processing agreements with

processors

  • Controllers must control processors
  • Processors must process data only on documented

instructions from the controller

slide-39
SLIDE 39

Blockc kchain an and GD GDPR March 5, 2019 Blockchain Hands On, Geneva Jörn Erbguth, joern@erbguth.ch #39

Public Blockchains vs. Permissioned Blockchains

Public Blockc kchains ! Who sends and signs a transaction is a controller ? Anonymity ? Processing agreements ? Liability Permissioned Blockc kchains ! Who attributes permissions is controller ! Processing agreements ! Liability ? Joint controller

slide-40
SLIDE 40

Blockc kchain an and GD GDPR March 5, 2019 Blockchain Hands On, Geneva Jörn Erbguth, joern@erbguth.ch #40

Five Ways to Cope with GDPR

  • Do not put any personal data (at all) on a blockchain
  • Use Privacy Enhancing Technology and ensure that it

does not leak personal data in any undesired way

  • Obtain a justification that is permanent
  • Let users put the data on a public blockchain themselves
  • Build specialized blockchains that forget
slide-41
SLIDE 41

Blockc kchain an and GD GDPR March 5, 2019 Blockchain Hands On, Geneva Jörn Erbguth, joern@erbguth.ch #41

https://erbguth.ch/QuickCheck

slide-42
SLIDE 42

Thank you for your attention!

Questions?