Protection of personal data in a blockchain

Blockchain technology is a blockchain with databases including personal data. In June 2024, the European Blockchain Sandbox released a report on the application of European legislation to the technology, including personal¹ data protection issues. Back in 2018. France provided guidance on how to comply with European personal data law when using² blockchain technology.

It is important to note that the recommendations on the application of personal data legislation are primarily designed for private blockchain networks (e.g. Ethereum Enterprise), regulators note that the application of the recommendations to public blockchain networks (e.g. Bitcoin) requires further elaboration.

The EU and France experience

Personal data is data that directly or indirectly identifies a specific natural person. The EU and France highlight the following aspects impacting the protection of personal data in blockchain:

1. Types of data that are deemed to be personal data:

- Private keys (allowing confirmation of a transaction or action on blockchain) that belong to a specific individual. For example, a cryptocurrency wallet password.

- Hashed transaction/action data (any data processed by the blockchain's encryption function). For example, data on the transfer of crypto-assets or other information between crypto-wallets.

- Data stored on the blockchain that is associated with user's credentials or data located outside the blockchain (e.g., account login data on the blockchain such as login and password).

- Product-specific data on the blockchain that may not be recognized as personal but is associated with an identifiable person. For example, data about a user's IP address.

The above types of data that can be used in a blockchain become personalized if they allow the data controller to identify the person to whom they belong. For example, the operator can determine who owns the hash (identifying the person who created the hash and the time) or who owns the private key used in the blockchain. This is possible due to the use of the "commit" function in the blockchain, which allows data to be "frozen" (hashed) in such a way that it is possible to recognize encrypted data if additional information (e.g., data from other databases) is available.

In the 2016 Breyer case, the EU Court of Justice already recognized that an IP address relates to personal data if the platform provider has the technical means to identify the specific person to whom the IP address belongs including by using data from third parties like internet service providers.

2. Blockchain participants that must comply with privacy regulations.

In blockchain, participants who define purposes and record data on blockchain or decide to send data for validation by miners are controllers under the EU personal data law. For example, a notary (as a natural person) who makes a blockchain entry to record the transaction, determining that data is recorded in execution of such a transaction. Or a bank (as a legal entity) that enters its customers' data into blockchain (recording third-party data in the system). At the same time, a person cannot have the status of a controller over their own data. For example, a person who buys or sells bitcoin in their own name.

Miners will be recognized as processors of personal data within the meaning of EU law because they have access to transaction data (including hashes) that may include personal data, as well as a smart contract developer who processes personal data received from the person collecting such data (the controller). For example, when a smart contract developer for a transaction receives data from a notary public and a miner validates and writes that transaction to the blockchain.

At the same time, data processors do not include:

− Smart contract parties, as natural persons are not considered processors of their own data.

− Developers of smart contract algorithm unless they have access to personal data, but only technically develop IT solutions.

3. Ita Ensuring the right to delete data from the blockchain (EU, France).

The right of the personal data subject to deletion means the right to request the controller to destroy the collected data. The right to personal data erasure on the blockchain is realized when a private key or hash that may contain personal data, including those encrypted via hash, is deleted.

Russia’s experience

In Russia, there are no special regulations of the authorities on personal data protection in blockchain, which creates risks of law violation. Also, unlike in the EU and France, the status of data controller and data processor is not differentiated. This means that in practice in Russia, any blockchain participants who are involved in working with data fall under the definition of a data controller under Russian law (e.g., miners). However, in practice, each blockchain participant can comply with the requirements for personal data operators only to the extent that is part of their function as a participant in the blockchain system. For example, the developer of a smart contract can ensure security measures for data processing but cannot control the legality of the grounds for collecting personal data recorded in the blockchain (e.g., the existence of consent of the data subject).

From the monitoring issue No. 6, June 2024. Download the full issue (PDF) · issue page at the Gaidar Institute