EU must scrap ill-fitting GDPR rules for blockchains or miss out

Last month, the European Data Protection Board (EDPB) quietly published Guidelines 02/2025 on the processing of personal data through blockchain technologies. Buried in paragraph 63 is a line that jolted the entire web3 stack: “When deletion has not been taken into account by design, this may require deleting the whole blockchain.”

That one clause converts GDPR from the world’s privacy gold standard into a kill-switch for every permissionless network. Yes, that includes Bitcoin (BTC), Ethereum (ETH), and the hundreds that settle trillions of dollars a year.

You might also like: The moment for mass adoption is here, and crypto’s still not ready | Opinion

The reality is worse than it seems because deleting every node is the only surefire way to “forget” a transaction. The guideline effectively makes permissionless networks non-compliant by default. Public consultation comes to a close on June 9—after that, the text hardens into Europe’s enforcement playbook. After that, Europe’s future is set.

GDPR was never written for tamper-proof ledgers

The 2018 GDPR authors assumed that data lives on centrally controlled servers where a single operator can erase it. Fast-forward to modern-day public blockchains; the opposite is true. Blockchains are distributed, immutable, and borderless.

Public chains rely on thousands of independent nodes that jointly guarantee history. Since rewriting a block would destroy that integrity, Article 17’s “right to be forgotten” collides head-first with the very feature that makes blockchains trustworthy.

Techniques such as salted hashes, zero-knowledge proofs, and off-chain data pointers already minimize or obfuscate personal information—the new draft barely acknowledges them. Instead, it assumes that a single “data controller” can be identified, which is another notion that undermines decentralization and permissionless network integrity.

Sovereign-cloud ambitions are at risk

For two years, Brussels has promised a sovereign cloud—digital autonomy on European terms. The Commission’s latest policy goals are explicit. By 2030, three-quarters of EU businesses should run on cloud-edge technology; 10,000 climate-neutral edge nodes must be live, and the forthcoming Cloud and AI Development Act vows to triple the EU’s target=”_blank” rel=”nofollow”>hold roughly 70% of Europe’s cloud market. Members of the European Parliament warn that without an indigenous backbone, EU data remains one United States subpoena away from offshore exposure.

The only architecture that can realistically break that grip is a decentralized cloud in which infrastructure providers are coordinated by blockchain incentives, while data stays inside European data centres. If the EDPB renders those ledgers illegal by design, Brussels will hard-wire the very dependency it claims to end.

Paragraph 63 would kneecap Europe’s builders

By threatening whole-chain deletion whenever a single record cannot be erased, the draft injects existential risk into every European web3 project and ices any future venture funding. Its bias toward permissioned ledgers nudges developers back to the centralized silos policymakers say they oppose.

Labeling volunteer validators “data controllers” would saddle hobbyists with corporate-grade liability, shrink node participation, and weaken network security. Treating every peer-to-peer link as a regulated international transfer risks splintering global consensus behind national borders.

Requiring human overrides for smart contracts breaks composability and undermines everything from decentralized finance to on-chain Environmental Social and Governance reporting, which big energy companies have already piloted.

A joint call-to-action from the European Crypto Initiative (EUCI) and Web3Privacy Now warns that the draft guidelines “fundamentally threaten the existence of public blockchains” across Europe. What more evidence does the EU need to see that including this paragraph will kneecap its own builders?

Privacy-by-design beats prohibition

A cleaner path preserves both privacy and decentralization. Destroying an encryption key or proving in zero-knowledge that the key is irretrievable satisfies the intent of Article 17 without dismantling a ledger. The guidelines should recognize cryptographic deletion alongside physical erasure, state that a 32-byte on-chain hash is not personal data, and treat validators as processors rather than “controllers.”

Brussels has already shown through the Markets in Crypto-Assets Regulation that bespoke rules for frontier tech can be crafted without blanket bans. Striking the kill-switch sentence, codifying key-to-dust deletion, and clarifying validator status would align GDPR with technical reality, all while keeping Europe’s sovereign-cloud strategy alive.

The public-comment portal closes in less than a month, and unless paragraph 63 is rebalanced, Europe risks spending the next decade paying U.S. hyperscalers to host ‘sovereign’ data. Meanwhile, the rest of the world will build on auditable, privacy-preserving rails beyond Brussels’ reach.

With time fast running out, builders, investors, and policymakers should hit that comment portal now, before Europe locks itself out of its own digital future.

Read more: What’s missing from MiCA’s comprehensive crypto manifesto? | Opinion