Regulators in the European Union (EU) have released new guidance on blockchain technology as it pertains to the processing of personal data.
In a new report, the European Data Protection Board (EDPB) says that in order to properly comply with the EU’s General Data Protection Regulation (GDPR), “evaluations” may need to be conducted on how blockchains record data.
According to the EDPB, the evaluation should address the following questions:
“Will the data on the blockchain contain personal data?…
ii. If so, why is a blockchain necessary for this processing? (What is the rationale for this choice?
What are the alternatives?)
iii. What type of blockchain should be used? (Is a private blockchain sufficient? Can a permissioned
blockchain be used? Is a ‘zero-knowledge’ architecture possible?)
iv. What technical and organizational measures are used? (Will personal data be stored on or offchain? Are any privacy-enhancing technologies being used – if not, why?)”
The EDPB says that blockchains are not an exception to GDPR laws, and should take into account how they process certain data. To comply with GDPR, the regulator says blockchains may need to be completely deleted if the deletion of GDPR-relevant data isn’t already taken into account to the network’s original creation.
“Personal data must be erased once the purposes of the processing has been achieved and any
regulatory periods for retention have expired in order to conform to the principle of storage
limitation.
Data deletion at the individual level in a blockchain can be challenging and requires ad-hoc
engineered architectures. When deletion has not been taken into account by design, this may require
deleting the whole blockchain.”
In a post on LinkedIn, James Smith, special projects lead at the Ethereum Foundation, said the EU’s new guidelines may threaten the existence of public blockchains.
“What this means for Ethereum and Web3:
The very architecture of public blockchains like Ethereum is being challenged.
Without significant pushback, we’re facing a regulatory framework that fundamentally misunderstands decentralized technology.
This isn’t just about compliance headaches – it’s about whether public blockchains can legally operate in Europe.”
Generated Image: Midjourney
