Blockchain technology is on a collision course with EU privacy law

78 点作者 searchencrypt大约 7 年前

13 条评论

GlitchMr大约 7 年前

Well, yeah, there is a rather straightforward solution - just don't store any personal information on a blockchain.Is it practical? Sometimes yes. Some usecases won't be able to do that, and this is fine, they should just consider technologies other than a blockchain. Or if they really want to have blockchain, perhaps consider storing personal information in an external database with references to its fields on a blockchain. Possibly with a salted hash stored in a blockchain, so that it's possible to verify whether a value was changed. A matching checksum or an empty value (meaning a value removed due to GDPR requirements) would be fine.Edit: A removed comment suggested storing an encryption key in a database to decrypt data on a blockchain. This is another way of looking at it - essentially keep two parts, one on a blockchain, another outside of blockchain - and you need both to decode the data while the part outside of blockchain could be removed.

评论 #16540031 未加载

评论 #16539274 未加载

antsykarbo大约 7 年前

Clickbaity headline. It's not the "blockchain technology" as a whole, but some specific use of it that can potentially violate the GDPR. You don't need a blockchain to violate the law: you can do it with paper or mysql or usb keys.Bottom line is: don't put your customers' personal data onto anything that you don't control.Nothing to see here.

评论 #16539674 未加载

mamon大约 7 年前

There's a very naive assumption in the article that Blockchain being incompatible with GDPR issue can be resolved by altering GDPR.I think it is impossible: GDPR is specifically designed to prevent sensitive personal information from leaking and information about one's financial transactions is one of the most sensitive pieces of information there is.So, if GDPR versus Blockchain case ever reaches any EU court the only possible ruling is to outlaw the Blockchain technology (at least in it's current incarnation).

评论 #16538850 未加载

KaiserPro大约 7 年前

Well yes and no.The prevention of fraud countermands GDPR, so keeping the financial transactions of anonymous IDs in a public, reasonbly immutable format, is not going to be a problem, infact its going to be encouraged, because data portability is also another key feature of GDPR.Storing people's personal pictures, well then yes, you have a problem. But then its a stupid place to keep private, non-public interest photos.

professorTuring大约 7 年前

Definitely it was a good read, but let me just focus on the main point.It is true that Blockchain technology has been thought as a replacement of a trusted third party like a notary or central register, but usually those are public registries: household ownerships, public offers... And those registries are usually exceptions or are treated in a different way (and usually they are explicitly regulated by each country). A few of them are even public, like the defaulters list in Spain.Also, it is quite naive to think that an European citizen can erase "any personal data", that could be quite convenient to erase your fresh new mortgage or obligations. You are only allowed to ask for irrelevant information to be removed not for specific business related log even if they have your personal data in them.

评论 #16539793 未加载

评论 #16539566 未加载

评论 #16539467 未加载

TomK32大约 7 年前

Wouldn't it easy for a blockchain to just reference external data which then get deleted to comply with GDPR? I know, breaks some ideas about storing data in the chain, but if that's the compromise that works. In the end it will all be about the specific implementation of each blockchain, the idea of blockchains in general will never be endangered like u/mamon suggested.

emef大约 7 年前

If you put data that's considered personal into a public blockchain, or any decentralized system, who becomes the owner of that data? Was it the company/service that originally published it on the blockchain? or is every node required to treat it as their own GDPR-compliant data?

评论 #16538780 未加载

评论 #16538846 未加载

评论 #16538817 未加载

AlexandrB大约 7 年前

Some of the comments By interviewees in this article are so backwards it's comical:> "From a practitioner's perspective, it sounds to me that it was drafted by trying to implement a certain perspective of how the world should be without taking into account how technology actually works," Steiner said. "The way [public decentralized network] architecture works, means there is no such thing as the deletion of personal data. The issue with information is once it's out, it's out."My answer to this is - don't put personal information in the blockchain then! What's the purpose of technology that doesn't serve human needs?It's a bizarre worldview that positions technology as the master, not the servant of mankind.

评论 #16538773 未加载

评论 #16539163 未加载

giancarlostoro大约 7 年前

This assumes if it's a direct fork of Bitcoin and not focused on privacy like Monero or Bytecoin.

BjoernKW大约 7 年前

GDPR is not only conflicting with some Blockchain use cases but with old-fashioned ledgers and paper-based accounting as well because the same principles apply here, too (an entry cannot be deleted, its effect can merely be reversed).If followed to the letter GDPR would've major repercussions on tax regulations because as a company you're legally bound to keep accounting records for at least 10 years whereas according to GDPR you're required to delete any record if asked by a person whose personal data appears in that record.The solution in that case is that GDPR only applies if it doesn't contradict other, already existing laws.So, where Blockchain applications facilitate legal requirements or don't manage personal data this should be perfectly fine but yes, other types of Blockchain applications are pretty much ruled out by GDPR.

评论 #16539033 未加载

fastball大约 7 年前

1. Encrypt your personal data with a private key that you control.2. Put encrypted personal data on a blockchain.3. When a 3rd party wants to use your data, give them your private key. They can store this in their own database so that they can access your blockchain data whenever they wish.4. To invoke your "right to be forgotten", simply ask the 3rd party to delete your private key.Am I missing something?

评论 #16539941 未加载

gruez大约 7 年前

one drunken night you decide to put some random piece of private information on the bitcoin/etherum blockchain. can you invoke your "right to be forgotten"? if so, can you c&d every node in the EU to take down your info?

评论 #16543942 未加载

arisAlexis大约 7 年前

blockchain technology is the most transparent