Blockchain is poised to be business disputer, however “Public Blockchains” and GDPR are incompatible. CNIL has provided guidance on #blockchain and GDRP and how it impacts the right to be forgotten. (Thread 1/10 ) #dragonchain

In essence, if the data stored on a blockchain is only referencing data stored off-chain, controllers may comply with requests for erasure from data subjects by removing the underlying data. (2/ 10)
Similarly, if the underlying data can only be accessed or verified via a specific private key, then making the private key inaccessible may also constitute an effect similar to the erasure of data. (3/ 10)
The CNIL provides some guidance on how individuals and companies might minimize their GDPR risk around blockchain technology. (4 / 10)
First, the CNIL recommends that companies seeking to process large amounts of personal data using blockchain technology rely on private blockchains over public blockchains. (5/10)
The CNIL favors private blockchains largely because of the geographic issues associated with public blockchain node operation. (6/10)
The CNIL notes that there is tension between the principle of data retention periods (Article 5 of the GDPR) and the permanence of blockchain transaction information. (7/10)
For public address hash values and public keys there is no data minimization option available due to the technical specifications of blockchains. (8/10)
For payload data committed to a blockchain, data minimization principles should be applied such that the data is cryptographically secured via encryption or by including references to the underlying data (stored elsewhere) in the form of a hash value in the payload. (9/10)
@dragonchaingang is spot on to meet the CNIL #blockchain guidance. Read more here: https://t.co/Lm88iY24vp (10/10) #dragonchain #gdpr #perkinscoien #cnil

More from All

You May Also Like