Is GDPR a Roadblock to Blockchain? 1. Swiss Symposium Blockchain - - PowerPoint PPT Presentation

▶
is gdpr a roadblock to blockchain
SMART_READER_LITE
LIVE PREVIEW

Is GDPR a Roadblock to Blockchain? 1. Swiss Symposium Blockchain - - PowerPoint PPT Presentation

Oct 27, 2023 371 likes •741 views

Is GDPR a Roadblock to Blockchain? 1. Swiss Symposium Blockchain Research, Zurich, May 14th Jrn Erbguth, Dipl.-Inf., Dipl.-Jur. Consultant Legal Tech, Blockchain, Smart Contracts and Data Protection PhD candidate, University of Geneva

slide-1
SLIDE 1

Is GDPR a Roadblock to Blockchain?

  • 1. Swiss Symposium Blockchain Research, Zurich, May 14th

Jörn Erbguth, Dipl.-Inf., Dipl.-Jur. Consultant Legal Tech, Blockchain, Smart Contracts and Data Protection PhD candidate, University of Geneva joern@erbguth.ch +41 787256027

slide-2
SLIDE 2

Is Is GDPR GDPR a Ro Roadblock to to Bl Blockchain? 1. Swiss Symposium Blockchain Research, May 14th, 2019 Jörn Erbguth, joern@erbguth.ch #2

Agenda

  • Article 8 of the Charter of Fundamental Rights and GDPR
  • The main conflicts of blockchain & GDPR
  • How to evaluate GDPR compliance
  • 5 ways that blockchain applications can cope with GDPR
slide-3
SLIDE 3

Is Is GDPR GDPR a Ro Roadblock to to Bl Blockchain? 1. Swiss Symposium Blockchain Research, May 14th, 2019 Jörn Erbguth, joern@erbguth.ch #3

Charter of Fundamental Rights of the European Union

slide-4
SLIDE 4

Is Is GDPR GDPR a Ro Roadblock to to Bl Blockchain? 1. Swiss Symposium Blockchain Research, May 14th, 2019 Jörn Erbguth, joern@erbguth.ch #4

What does the GDPR protect?

slide-5
SLIDE 5

Is Is GDPR GDPR a Ro Roadblock to to Bl Blockchain? 1. Swiss Symposium Blockchain Research, May 14th, 2019 Jörn Erbguth, joern@erbguth.ch #5

GDPR in Relation to Other Fundamental Rights

slide-6
SLIDE 6

Is Is GDPR GDPR a Ro Roadblock to to Bl Blockchain? 1. Swiss Symposium Blockchain Research, May 14th, 2019 Jörn Erbguth, joern@erbguth.ch #6

GDPR vs. Blockchain

GDPR Blockchain

Ri Right to …

  • Art. 16: rectification
  • Art. 17: erasure
  • Art. 18: restriction of processing

immutable public

slide-7
SLIDE 7

Is Is GDPR GDPR a Ro Roadblock to to Bl Blockchain? 1. Swiss Symposium Blockchain Research, May 14th, 2019 Jörn Erbguth, joern@erbguth.ch #7

GDPR vs. Blockchain

GDPR Blockchain

Cl Clear responsibilities controller processor distributed responsibility anonymous participation

slide-8
SLIDE 8

Is Is GDPR GDPR a Ro Roadblock to to Bl Blockchain? 1. Swiss Symposium Blockchain Research, May 14th, 2019 Jörn Erbguth, joern@erbguth.ch #8

General Data Protection Regulation (GDPR)

  • Processing of personal data is forbidden
  • Unless there is proper justification
  • Obligations for controllers and processors
  • Rights for data subjects
  • Includes obligation to information security
  • Fines up to 20 mill. € or 4% of worldwide annual turnover
slide-9
SLIDE 9

Is Is GDPR GDPR a Ro Roadblock to to Bl Blockchain? 1. Swiss Symposium Blockchain Research, May 14th, 2019 Jörn Erbguth, joern@erbguth.ch #9

How to evaluate GDPR compliance

  • Does GDPR apply?
  • Is there processing of personal data?
  • Is there a justification for the data processing?
  • Do I comply with the obligations of GDPR?
slide-10
SLIDE 10

Is Is GDPR GDPR a Ro Roadblock to to Bl Blockchain? 1. Swiss Symposium Blockchain Research, May 14th, 2019 Jörn Erbguth, joern@erbguth.ch #10

Does the GDPR apply? (Art. 2, 3)

  • Some entity that is considered a controller or a processor

is in the EU

  • Offering goods or services to data subjects in the EU
  • Monitoring behavior of data subjects in the EU
  • Not if only for personal use or household activity
slide-11
SLIDE 11

Is Is GDPR GDPR a Ro Roadblock to to Bl Blockchain? 1. Swiss Symposium Blockchain Research, May 14th, 2019 Jörn Erbguth, joern@erbguth.ch #11

Personal data (Art. 4.1)?

Any information relating to an identified or identifiable natural person

  • Pseudonymous data is personal data
  • Anonymous data is no

not personal data

Recital 26: To determine whether a natural person is identifiable, account should be taken

  • f al

all the e mean eans reas easonab ably likel ely to be e used ed ... either by the controller or by another person to identify the natural person directly or indirectly.

slide-12
SLIDE 12

Is Is GDPR GDPR a Ro Roadblock to to Bl Blockchain? 1. Swiss Symposium Blockchain Research, May 14th, 2019 Jörn Erbguth, joern@erbguth.ch #12

Examples of personal data

ü IP addresses ü Bitcoin addresses ü “anonymized” movement profile ü “anonymized” browsing history ✗ aggregated movement profiles ✗ aggregated browsing history

At Attent ention:

  • n: Look

Look at at the he indi ndivi vidual dual case case – do do no not gene neralize

slide-13
SLIDE 13

Is Is GDPR GDPR a Ro Roadblock to to Bl Blockchain? 1. Swiss Symposium Blockchain Research, May 14th, 2019 Jörn Erbguth, joern@erbguth.ch #13

Encryption

Deletion of the encryption key = deletion of the content?

slide-14
SLIDE 14

Is Is GDPR GDPR a Ro Roadblock to to Bl Blockchain? 1. Swiss Symposium Blockchain Research, May 14th, 2019 Jörn Erbguth, joern@erbguth.ch #14

Use of Hash Values

Pu Public Pr Private

Encrypted Data

slide-15
SLIDE 15

Is Is GDPR GDPR a Ro Roadblock to to Bl Blockchain? 1. Swiss Symposium Blockchain Research, May 14th, 2019 Jörn Erbguth, joern@erbguth.ch #15

Use of Hash Values

Pu Public Pr Private

Data

slide-16
SLIDE 16

Is Is GDPR GDPR a Ro Roadblock to to Bl Blockchain? 1. Swiss Symposium Blockchain Research, May 14th, 2019 Jörn Erbguth, joern@erbguth.ch #16

Cryptographic hash functions

  • Serve as digital fingerprints
  • Virtually unique
  • Fixed length (e.g. 32 bytes)
  • For digital objects of any size

Demo 2

slide-17
SLIDE 17

Is Is GDPR GDPR a Ro Roadblock to to Bl Blockchain? 1. Swiss Symposium Blockchain Research, May 14th, 2019 Jörn Erbguth, joern@erbguth.ch #17

GDPR-compliant use of hash values

slide-18
SLIDE 18

Is Is GDPR GDPR a Ro Roadblock to to Bl Blockchain? 1. Swiss Symposium Blockchain Research, May 14th, 2019 Jörn Erbguth, joern@erbguth.ch #18

Non-GDPR-compliant use of hash values

has diploma

slide-19
SLIDE 19

Is Is GDPR GDPR a Ro Roadblock to to Bl Blockchain? 1. Swiss Symposium Blockchain Research, May 14th, 2019 Jörn Erbguth, joern@erbguth.ch #19

Adding Salt and Pepper to Hashes

  • Ensuring enough en

entropy py

  • Making guessing practically impossible
  • Can prevent rainbow table attacks
  • Can prevent parallel attacks
slide-20
SLIDE 20

Is Is GDPR GDPR a Ro Roadblock to to Bl Blockchain? 1. Swiss Symposium Blockchain Research, May 14th, 2019 Jörn Erbguth, joern@erbguth.ch #20

How to Hash Data

slide-21
SLIDE 21

Is Is GDPR GDPR a Ro Roadblock to to Bl Blockchain? 1. Swiss Symposium Blockchain Research, May 14th, 2019 Jörn Erbguth, joern@erbguth.ch #21

How to Hash Data

slide-22
SLIDE 22

Is Is GDPR GDPR a Ro Roadblock to to Bl Blockchain? 1. Swiss Symposium Blockchain Research, May 14th, 2019 Jörn Erbguth, joern@erbguth.ch #22

How to Hash Data

slide-23
SLIDE 23

Is Is GDPR GDPR a Ro Roadblock to to Bl Blockchain? 1. Swiss Symposium Blockchain Research, May 14th, 2019 Jörn Erbguth, joern@erbguth.ch #23

How to Hash Data

slide-24
SLIDE 24

Is Is GDPR GDPR a Ro Roadblock to to Bl Blockchain? 1. Swiss Symposium Blockchain Research, May 14th, 2019 Jörn Erbguth, joern@erbguth.ch #24

Test: Can you derive Personal Information?

Is it possible to derive data from the blockchain even when all information outside the blockchain is deleted? What if

  • somebody knows one transaction, can she see further

transactions of the same person?

  • somebody knows part of a transaction, can she see

further details?

  • somebody knows personal details of a person, can she

discover information about that person’s activity?

slide-25
SLIDE 25

Is Is GDPR GDPR a Ro Roadblock to to Bl Blockchain? 1. Swiss Symposium Blockchain Research, May 14th, 2019 Jörn Erbguth, joern@erbguth.ch #25

Zero-Knowledge Proof

Proof of knowing something without revealing it

slide-26
SLIDE 26

Is Is GDPR GDPR a Ro Roadblock to to Bl Blockchain? 1. Swiss Symposium Blockchain Research, May 14th, 2019 Jörn Erbguth, joern@erbguth.ch #26

Zero-Knowledge Proof – Zcash

  • Limiting the purpose of using personal data by technical means
  • Only the correctness of the transaction can be proven
  • Privacy by design
slide-27
SLIDE 27

Is Is GDPR GDPR a Ro Roadblock to to Bl Blockchain? 1. Swiss Symposium Blockchain Research, May 14th, 2019 Jörn Erbguth, joern@erbguth.ch #27

Advantages

  • Protection also against insiders (e.g. admins)
  • Access rights cannot be modified retroactively
  • Protection against intruders that breach the firewall
  • Data is protected against manipulation
slide-28
SLIDE 28

Is Is GDPR GDPR a Ro Roadblock to to Bl Blockchain? 1. Swiss Symposium Blockchain Research, May 14th, 2019 Jörn Erbguth, joern@erbguth.ch #28

Lawfulness of processing (Art. 6)

  • Consent (Art. 6.1 a)
  • Performance of a contract (Art. 6.1 b)
  • Compliance with a legal obligation (Art. 6.1 c)
  • Legitimate interest (Art. 6.1 f)
slide-29
SLIDE 29

Is Is GDPR GDPR a Ro Roadblock to to Bl Blockchain? 1. Swiss Symposium Blockchain Research, May 14th, 2019 Jörn Erbguth, joern@erbguth.ch #29

Controllers, Processors, Data Subjects

Controller Processor

Determines the purposes and means of processing Processes data

  • n behalf of the controller

Data-Subjects

slide-30
SLIDE 30

Is Is GDPR GDPR a Ro Roadblock to to Bl Blockchain? 1. Swiss Symposium Blockchain Research, May 14th, 2019 Jörn Erbguth, joern@erbguth.ch #30

Who is “Controller” and who is “Processor”?

  • Node operators?
  • Miner who mines a specific block?
  • All miners together?
  • User who signs a transaction with her private key?
  • Exchange or wallet service that signs a transaction on behalf
  • f a user?
  • Entity that administrates permissions for a permissioned

blockchain?

slide-31
SLIDE 31

Is Is GDPR GDPR a Ro Roadblock to to Bl Blockchain? 1. Swiss Symposium Blockchain Research, May 14th, 2019 Jörn Erbguth, joern@erbguth.ch #31

Opinion of the CNIL on Controllers and Processors

  • User of a public blockchain is a controller
  • Somebody who creates and controls a permissioned

blockchain is a controller

  • Members of a consortium can be joint controllers
  • Node operators are processors
  • Smart contract developers can be processors,

if they retain control

slide-32
SLIDE 32

Is Is GDPR GDPR a Ro Roadblock to to Bl Blockchain? 1. Swiss Symposium Blockchain Research, May 14th, 2019 Jörn Erbguth, joern@erbguth.ch #32

Duties of Controllers and Processors

  • Controllers must identify themselves
  • Controllers are responsible towards data subjects
  • Controllers must have processing agreements with

processors

  • Controllers must control processors
  • Processors must process data only on documented

instructions from the controller

slide-33
SLIDE 33

Is Is GDPR GDPR a Ro Roadblock to to Bl Blockchain? 1. Swiss Symposium Blockchain Research, May 14th, 2019 Jörn Erbguth, joern@erbguth.ch #33

Five Ways to Cope with GDPR

  • Do not put any personal data (at all) on a blockchain
  • Use Privacy Enhancing Technology and ensure that no

personal information can be derived from the blockchain

  • Obtain a justification that is permanent
  • Let users put the data on a public blockchain themselves
  • Build specialized blockchains that forget
slide-34
SLIDE 34

Is Is GDPR GDPR a Ro Roadblock to to Bl Blockchain? 1. Swiss Symposium Blockchain Research, May 14th, 2019 Jörn Erbguth, joern@erbguth.ch #34

https://erbguth.ch/QuickCheck

slide-35
SLIDE 35

Is Is GDPR GDPR a Ro Roadblock to to Bl Blockchain? 1. Swiss Symposium Blockchain Research, May 14th, 2019 Jörn Erbguth, joern@erbguth.ch #35

Thank you – Questions?