Data protection/GDPR and blockchain — on a collision course

Existing data protection legislation in the UK, and upcoming legislation from GDPR is fundamentally incompatible with blockchains.

This article predates introduction of GDPR-directed legislation within the UK, but there are some things that we know are very likely to happen upon its introduction. One of the more stimulating ideas within GDPR is a “right to be forgotten”.

In fact, the principle of a “right to be forgotten” exists in data protection laws in the UK already — the Data Protection Act 1998 just doesn’t have a particularly strong way of saying that an individual can ask for their personal data to be deleted. It’s down to the data controller to decide if you ask them, and if they don’t it’s down to you to prove to a court that they should.

The actual function of “right to be forgotten” is, in computer science terms, simply a deletion. Your personal data is in some system, and you ask for it to be removed. If the computer system in question is a database, this is — and I’m hand-waving a lot of complexity here — simply a matter of deleting the rows, or “typing over” the data to render it no longer identifiable as being about you. The court doesn’t care how this is done — or how much it costs — the fact is that it can be done relatively easy with all modern SQL-based or even NoSQL databases.

(Of course, this doesn’t answer issues relating to backups. If you’re looking to expunge someone’s personal data entirely from a computer system, you have to touch not only the live data, but also the backups. And/or you’d have to fixup any data that was restored if you had to go back and make an old version of data live.)

But, again, these are all problems that exist with the existing Act. GDPR adds a wrinkle as exercising the right to be forgotten is more straightforward and more skewed towards the individual, but the fundamentals are there.

The blockchain, however, is an entirely different form of database. If the actual personal data is embedded within the blockchain, how can you delete it? You can’t physically remove the records without regenerating the blockchain again from that point — and the principle of a blockchain expressly prevents you from doing that. You could have transactions further down the change that annotates or mark suspect data, but the base data will still remain. An individual can still suffer damage because the data exists in some form. Essentially, you cannot “delete” from the blockchain in the same way that you can from virtually any other sort of database.

There are other issues with data protection legislation, and the blockchain. Namely that someone has to “own” the data. The purpose of this ownership goes to the fact that the court has to order someone to actually be responsible for (in our case) deleting or marketing the data as suspect. Blockchains, again by design don’t have an owner, so a court can’t make orders that affect blockchains.

Personally, I don’t like to write blog articles without offering a solution, but the issue here seems is that data protection legislation, whether it’s the GDPR within the EU, or GDPR-directed legislation in the UK, or other laws around the world are at odds with how blockchains works.

If you’ve enjoyed this article, would you do me a favour and click on the “Clap” button below? It’s a silly term, but it helps promote my work to a larger audience. #ThankYou