On 25 May 2018, the General Data Protection Regulation (GDPR) of the European Union entered into force, accompanied by some uncertainties regarding its application. For example, some legal commentators believe there are "irreconcilable" differences between blockchain technologies and some of GDPR's core principles, raising doubts as to whether the technology can achieve widespread adoption under the new data protection regime.
Blockchain technology rose to fame as the underpinning of the Bitcoin system, but there are a myriad of applications for it beyond transacting in cryptocurrencies, such as executing contracts and even authenticating fine art.
Nigel Houlden, head of technology policy at the Information Commissioner's Office (ICO)—the body responsible for enforcing data protection and privacy regulations in the United Kingdom—stated that he has "nightmares" about the future relationship between blockchain and some of GDPR's core principles. One of the tensions revolves around the so-called "right to be forgotten."
Pursuant to Article 17, "[t]he data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay." However, this might not be possible if that personal data is stored on an immutable, open blockchain, in which each block of data contains a hash of the previous one. By design, a blockchain is resistant to modification of the data, which is argueably one of the technology's core advantages. There are, of course, exemptions from the right to erasure in Article 17. However, it is unclear whether any of those exemptions might apply to blockchain. It is also unclear whether cryptographic information on a blockchain will qualify as personal information in all circumstances.
We will update you on further blockchain and GDPR-related issues soon.
Originally published June 13, 2018
Mayer Brown is a global legal services provider comprising legal practices that are separate entities (the "Mayer Brown Practices"). The Mayer Brown Practices are: Mayer Brown LLP and Mayer Brown Europe – Brussels LLP, both limited liability partnerships established in Illinois USA; Mayer Brown International LLP, a limited liability partnership incorporated in England and Wales (authorized and regulated by the Solicitors Regulation Authority and registered in England and Wales number OC 303359); Mayer Brown, a SELAS established in France; Mayer Brown JSM, a Hong Kong partnership and its associated entities in Asia; and Tauil & Chequer Advogados, a Brazilian law partnership with which Mayer Brown is associated. "Mayer Brown" and the Mayer Brown logo are the trademarks of the Mayer Brown Practices in their respective jurisdictions.
© Copyright 2018. The Mayer Brown Practices. All rights reserved.
This Mayer Brown article provides information and comments on legal issues and developments of interest. The foregoing is not a comprehensive treatment of the subject matter covered and is not intended to provide legal advice. Readers should seek specific legal advice before taking any action with respect to the matters discussed herein.