Blockchain and GDPR Blockstack Decentralizing the World Tour, - - PowerPoint PPT Presentation

▶
blockchain and gdpr
SMART_READER_LITE
LIVE PREVIEW

Blockchain and GDPR Blockstack Decentralizing the World Tour, - - PowerPoint PPT Presentation

Jun 22, 2023 526 likes •970 views

Blockchain and GDPR Blockstack Decentralizing the World Tour, December 18, 2018, Prague Jrn Erbguth, Dipl.-Inf., Dipl.-Jur. Consultant Legal Tech, Blockchain, Smart Contracts and Data Protection joern@erbguth.ch +41 787256027 GDPR vs.

slide-1
SLIDE 1

Blockchain and GDPR

Blockstack Decentralizing the World Tour, December 18, 2018, Prague Jörn Erbguth, Dipl.-Inf., Dipl.-Jur. Consultant Legal Tech, Blockchain, Smart Contracts and Data Protection joern@erbguth.ch +41 787256027

slide-2
SLIDE 2

Blockc kchain an and GD GDPR December 18, 2018 Blockstack Decentralizing the World Tour, Prague Jörn Erbguth, joern@erbguth.ch #2

GDPR vs. Blockchain

GDPR Blockchain

Ri Right t to to …

  • Art. 16: rectification
  • Art. 17: erasure
  • Art. 18: restriction of processing

immutable public

slide-3
SLIDE 3

Blockc kchain an and GD GDPR December 18, 2018 Blockstack Decentralizing the World Tour, Prague Jörn Erbguth, joern@erbguth.ch #3

GDPR vs. Blockchain

GDPR Blockchain

Cl Clear r resp sponsi sibility controller processor distributed responsibility anonymous participation

slide-4
SLIDE 4

Blockc kchain an and GD GDPR December 18, 2018 Blockstack Decentralizing the World Tour, Prague Jörn Erbguth, joern@erbguth.ch #4

General Data Protection Regulation (GDPR)

  • Directly applicable European law
  • Processing of personal data is forbidden
  • Unless there is proper justification
  • Obligations for controllers and processors
  • Rights for data subjects
  • Fines up to 20 mill. € or 4% of worldwide annual turnover
slide-5
SLIDE 5

Blockc kchain an and GD GDPR December 18, 2018 Blockstack Decentralizing the World Tour, Prague Jörn Erbguth, joern@erbguth.ch #5

Does the GDPR apply? (Art. 2, 3)

  • Some entity that is considered a controller or a processor

is in the EU

  • Offering goods or services to data subjects in the EU
  • Monitoring behavior of data subjects in the EU
  • Not if only for personal use or household activity
slide-6
SLIDE 6

Blockc kchain an and GD GDPR December 18, 2018 Blockstack Decentralizing the World Tour, Prague Jörn Erbguth, joern@erbguth.ch #6

Personal data (Art. 4.1)?

Any information relating to an identified or identifiable natural person

  • Pseudonymous data is personal data
  • Anonymous data is not

not personal data

Recital 26: To determine whether a natural person is identifiable, account should be taken

  • f all the means reasonably like

kely to be used ... either by the controller or by another person to identify the natural person directly or indirectly.

slide-7
SLIDE 7

Blockc kchain an and GD GDPR December 18, 2018 Blockstack Decentralizing the World Tour, Prague Jörn Erbguth, joern@erbguth.ch #7

Examples of personal data

ü IP addresses ü Bitcoin addresses ü “anonymized” movement profile ü “anonymized” browsing history ✗ aggregated movement profiles ✗ aggregated browsing history

Attention: Look k at the individual case – do do n not g generalize

slide-8
SLIDE 8

Blockc kchain an and GD GDPR December 18, 2018 Blockstack Decentralizing the World Tour, Prague Jörn Erbguth, joern@erbguth.ch #8

Encryption

Deletion of the encryption key = deletion of the content?

slide-9
SLIDE 9

Blockc kchain an and GD GDPR December 18, 2018 Blockstack Decentralizing the World Tour, Prague Jörn Erbguth, joern@erbguth.ch #9

slide-10
SLIDE 10

Blockc kchain an and GD GDPR December 18, 2018 Blockstack Decentralizing the World Tour, Prague Jörn Erbguth, joern@erbguth.ch #10

GDPR-compliant deletion?

  • Deletion of the encryption key = deletion of the content?
  • Is there a remaining copy of the key?
  • Will the encryption method become insecure in the future?
slide-11
SLIDE 11

Blockc kchain an and GD GDPR December 18, 2018 Blockstack Decentralizing the World Tour, Prague Jörn Erbguth, joern@erbguth.ch #11

Use of Hash Values

Pu Public lic Priva Private

Encrypted Data

slide-12
SLIDE 12

Blockc kchain an and GD GDPR December 18, 2018 Blockstack Decentralizing the World Tour, Prague Jörn Erbguth, joern@erbguth.ch #12

Use of Hash Values

Pu Public lic Priva Private

Data

slide-13
SLIDE 13

Blockc kchain an and GD GDPR December 18, 2018 Blockstack Decentralizing the World Tour, Prague Jörn Erbguth, joern@erbguth.ch #13

Blockstack Architecture

slide-14
SLIDE 14

Blockc kchain an and GD GDPR December 18, 2018 Blockstack Decentralizing the World Tour, Prague Jörn Erbguth, joern@erbguth.ch #14

Cryptographic hash functions

  • Serve as digital fingerprints
  • Virtually unique
  • Fixed length (e.g. 32 bytes)
  • For digital objects of any size
  • One-way function

Demo 2

slide-15
SLIDE 15

Blockc kchain an and GD GDPR December 18, 2018 Blockstack Decentralizing the World Tour, Prague Jörn Erbguth, joern@erbguth.ch #15

Examples of cryptographic hashes

  • Switzerland

2275583196D791405892AACA0D87743C872F3FC0CF3308A6C3EF82528918AA8A

  • Switzerland.

43CF6F3ECA7253FFAB1FD5104172280189B91FDD5FA26774FCA6475FFA1E2EC9

  • A

8C4B4C4E211BA8C1A62DE2A3A6CA5AC8BFF501C14410100DD90D5077A0AC061E

slide-16
SLIDE 16

Blockc kchain an and GD GDPR December 18, 2018 Blockstack Decentralizing the World Tour, Prague Jörn Erbguth, joern@erbguth.ch #16

Kryptografische Hashwerte, datenschutzkonform

slide-17
SLIDE 17

Blockc kchain an and GD GDPR December 18, 2018 Blockstack Decentralizing the World Tour, Prague Jörn Erbguth, joern@erbguth.ch #17

Kryptografische Hashwerte, nicht datenschutzkonform

hat Diplom

slide-18
SLIDE 18

Blockc kchain an and GD GDPR December 18, 2018 Blockstack Decentralizing the World Tour, Prague Jörn Erbguth, joern@erbguth.ch #18

Use cases for cryptographic hash functions

  • Validate external documents
  • Time-stamping
  • Proof of Existence
  • Basic functionality for cryptography and DLT

Th The w wron

  • ng u

g use of

  • f h

hash f function

  • ns c

can l lead t to t

  • the

ide identif tific icatio tion of da data ta subje bjects ts!

slide-19
SLIDE 19

Blockc kchain an and GD GDPR December 18, 2018 Blockstack Decentralizing the World Tour, Prague Jörn Erbguth, joern@erbguth.ch #19

Adding Salt and Pepper to Hashes

  • Ensuring enough en

entropy

  • Making guessing really hard
  • Can prevent rainbow table attacks
  • Can prevent parallel attacks
slide-20
SLIDE 20

Blockc kchain an and GD GDPR December 18, 2018 Blockstack Decentralizing the World Tour, Prague Jörn Erbguth, joern@erbguth.ch #20

How to Hash Data

slide-21
SLIDE 21

Blockc kchain an and GD GDPR December 18, 2018 Blockstack Decentralizing the World Tour, Prague Jörn Erbguth, joern@erbguth.ch #21

How to Hash Data

slide-22
SLIDE 22

Blockc kchain an and GD GDPR December 18, 2018 Blockstack Decentralizing the World Tour, Prague Jörn Erbguth, joern@erbguth.ch #22

How to Hash Data

slide-23
SLIDE 23

Blockc kchain an and GD GDPR December 18, 2018 Blockstack Decentralizing the World Tour, Prague Jörn Erbguth, joern@erbguth.ch #23

How to Hash Data

slide-24
SLIDE 24

Blockc kchain an and GD GDPR December 18, 2018 Blockstack Decentralizing the World Tour, Prague Jörn Erbguth, joern@erbguth.ch #24

Test: Does your system leak personal data?

Does the system disclose personal data by itself? What if

  • somebody knows one transaction, can she see further

transactions of the same person?

  • somebody knows part of a transaction, can she see

further details?

  • somebody knows personal details of a person, can she

discover information about the person’s activity?

slide-25
SLIDE 25

Blockc kchain an and GD GDPR December 18, 2018 Blockstack Decentralizing the World Tour, Prague Jörn Erbguth, joern@erbguth.ch #25

Zero-Knowledge Proof

Proof of knowing something without revealing it

slide-26
SLIDE 26

Blockc kchain an and GD GDPR December 18, 2018 Blockstack Decentralizing the World Tour, Prague Jörn Erbguth, joern@erbguth.ch #26

Simple Zero Knowledge Proof

✓

Private Key Public Key

slide-27
SLIDE 27

Blockc kchain an and GD GDPR December 18, 2018 Blockstack Decentralizing the World Tour, Prague Jörn Erbguth, joern@erbguth.ch #27

Zero-Knowledge Proof – example

color blind color vision

slide-28
SLIDE 28

Blockc kchain an and GD GDPR December 18, 2018 Blockstack Decentralizing the World Tour, Prague Jörn Erbguth, joern@erbguth.ch #28

Zero-Knowledge Proof – Zcash

  • Technical purpose limitation of personal data
  • Only the correctness of the transaction can be proven
slide-29
SLIDE 29

Blockc kchain an and GD GDPR December 18, 2018 Blockstack Decentralizing the World Tour, Prague Jörn Erbguth, joern@erbguth.ch #29

Advantages

  • Protection also against insiders (e.g. admins)
  • Access rights cannot be modified retroactively
  • Protection against intruders that breach the firewall
  • Data is protected against manipulation
slide-30
SLIDE 30

Blockc kchain an and GD GDPR December 18, 2018 Blockstack Decentralizing the World Tour, Prague Jörn Erbguth, joern@erbguth.ch #30

Still personal data?

  • In a pre-GDPR opinion, DPAs said yes (Art. 29 WP, 05/14)
  • GDPR says, it depends
  • Risk that immutable data on blockchains become personal

data later

slide-31
SLIDE 31

Blockc kchain an and GD GDPR December 18, 2018 Blockstack Decentralizing the World Tour, Prague Jörn Erbguth, joern@erbguth.ch #31

Opinion of the CNIL

Order of Preference

  • Zero-Knowledge Proof
  • Hashes with secret key (peppered hashes)
  • Encryption
  • Hashes without additional secret key
  • Clear text
slide-32
SLIDE 32

Blockc kchain an and GD GDPR December 18, 2018 Blockstack Decentralizing the World Tour, Prague Jörn Erbguth, joern@erbguth.ch #32

Chameleon Hash Functions

  • Hash functions that can be reversed with a private key
  • Enables modifiable blockchains
  • Modification remains visible
  • Modification can be subject to conditions
  • Modification should be limited to specific parts of a

transaction

slide-33
SLIDE 33

Blockc kchain an and GD GDPR December 18, 2018 Blockstack Decentralizing the World Tour, Prague Jörn Erbguth, joern@erbguth.ch #33

Chameleon Hash1

Chameleon Hash Functions

slide-34
SLIDE 34

Blockc kchain an and GD GDPR December 18, 2018 Blockstack Decentralizing the World Tour, Prague Jörn Erbguth, joern@erbguth.ch #34

Chameleon Hashfunctions

Immutable Part of Tx1 Changeable Part of Tx 1

X

Condition Partial Hash (conventional) Partial Hash (conventional) Partial Hash (Chameleon) Hash1

✗

slide-35
SLIDE 35

Blockc kchain an and GD GDPR December 18, 2018 Blockstack Decentralizing the World Tour, Prague Jörn Erbguth, joern@erbguth.ch #35

When to Use Chameleon Hash Functions?

  • Some part of the data on a blockchain should stay immutable
  • Another part of the data shall be deleted or changed after a

certain time under specific conditions

  • It is known in advance, what part of the data needs to be

immutable and what part needs to be changeable

slide-36
SLIDE 36

Blockc kchain an and GD GDPR December 18, 2018 Blockstack Decentralizing the World Tour, Prague Jörn Erbguth, joern@erbguth.ch #36

Lawfulness of processing (Art. 6)

  • Consent (Art. 6.1 a)
  • Performance of a contract (Art. 6.1 b)
  • Compliance with a legal obligation (Art. 6.1 c)
  • Legitimate interest (Art. 6.1 f)
slide-37
SLIDE 37

Blockc kchain an and GD GDPR December 18, 2018 Blockstack Decentralizing the World Tour, Prague Jörn Erbguth, joern@erbguth.ch #37

Who is “Controller” and who is “Processor”?

  • Node operators?
  • Miner who mines a specific block?
  • All miners together?
  • User who signs a transaction with her private key?
  • Exchange or wallet service that signs a transaction on

behalf of a user?

slide-38
SLIDE 38

Blockc kchain an and GD GDPR December 18, 2018 Blockstack Decentralizing the World Tour, Prague Jörn Erbguth, joern@erbguth.ch #38

Opinion of the CNIL on controllers and processors

  • User of a public blockchain is a controller
  • Somebody who creates and controls a permissioned

blockchain is a controller

  • Members of a consortium can be joint controllers
  • Node operators are processors
  • Smart contract developers can be processors, but only if

they retain control of the smart contract

slide-39
SLIDE 39

Blockc kchain an and GD GDPR December 18, 2018 Blockstack Decentralizing the World Tour, Prague Jörn Erbguth, joern@erbguth.ch #39

Duties of controllers and processors

  • Controllers must identify themselves
  • Controllers are responsible towards data subjects
  • Controllers must have processing agreements with

processors

  • Controllers must control processors
  • Processors must process data only on documented

instructions from the controller

slide-40
SLIDE 40

Blockc kchain an and GD GDPR December 18, 2018 Blockstack Decentralizing the World Tour, Prague Jörn Erbguth, joern@erbguth.ch #40

Public Blockchains vs. Permissioned Blockchains

Public Blockc kchains ! Who sends and signs a transaction is a controller ? Anonymity ? Processing agreements ? Liability Permissioned Blockc kchains ! Who attributes permissions is controller ! Processing agreements ! Liability ? Joint controller

slide-41
SLIDE 41

Blockc kchain an and GD GDPR December 18, 2018 Blockstack Decentralizing the World Tour, Prague Jörn Erbguth, joern@erbguth.ch #41

https://erbguth.ch/QuickCheck

slide-42
SLIDE 42

Thank you for your attention!

Questions?