A Decentralized Personal Data Store based on Ethereum: Towards GDPR Compliance

Abstract

Sharing personal data with service providers is a fundamental resource for the times we live in. But data sharing represents an unavoidable issue, due to improper data treatment, lack of users' awareness to whom they are sharing with, wrong or excessive data sharing from end users who ignore they are exposing personal information. The problem becomes even more complicate if we try to consider the devices around us: how to share devices we own, so that we can receive pervasive services, based on our contexts and device functionalities. The European Authority has provided the General Data Protection Regulation (GDPR), in order to implement protection of sensitive data in each EU member, throughout certification mechanisms (according to Art. 42 GDPR). The certification assures compliance to the regulation, which represent a mandatory requirement for any service which may come in contact with sensitive data. Still the certification is an open process and not constrained by strict rule. In this paper we describe our decentralized approach in sharing personal data in the era of smart devices, being those considered sensitive data as well. Having in mind the centrality of users in the ownership of the data, we have proposed a decentralized Personal Data Store prototype, which stands as a unique data sharing endpoint for third party services. Even if blockchain technologies may seem fit to solve the issue of data protection, because of the absence of a central authority, they lay to additional concerns especially relating such technologies with specifications described in the regulation. The current work offers a contribution in the advancements of personal data sharing management systems in a distributed environment by presenting a real prototype and an architectural blueprint, which advances the state of the art in order to meet the GDPR regulation. Address those arisen issues, from a technological perspective, stands as an important challenge, in order to empower end users in owning their personal data for real.

A Gap Between Blockchain and General Data Protection Regulation: A Systematic Review

“…A smart contract can be a useful tool for implementing consent in the blockchain. Many previous studies have proposed the use of a smart contract-based consent model [31], [33], [40], [43], [45], [46], [57], [60], [61], [63], [64], [66], [67], [74], [75], [79]- [83], [87]- [90]. In such models, a data subject encodes an access policy or Terms of Service agreement using smart contract language (java, go) and shares it with controller.…”

“…Smart contracts are programmed by humans; hence, they can sometimes be erroneous and cannot be encoded accurately and consistently. Many researchers have proposed a consent ontology model to solve this problem [31], [33], [61], [75], [80]- [82], [87]. Consent ontology systematically constructs knowledge expression for the various types of data, such as regulation, the privacy policy of service providers (controller), and consent or withdrawal of data subjects, and provides inference.…”

“…When the data stored in off-chain storage are deleted or modified, only the fact that a specific content version existed at a specific point in time is left in the blockchain. Many articles have adopted off-chain storage methods [31]- [47], [60]- [62], [64], [71]- [75], [77], [80]- [82], [87]- [89]. However, the following are several serious problems associated with off-chain methods: 1) the goals of the blockchain may be ignored [27]; 2) complexity and additional delays in transferring on-chain data to off-chain storage may occur; 3) the security level of the blockchain reduces [47]; 4) this method makes the system inconsistent.…”

“…The requirements depend on the type of blockchain. Every user can access transactions directly or through a smart contract in a Side-chain [31]- [47], [60]- [62], [64], [71]- [75], [77], [80]- [82], [87]- [89] Off-chain Bypassing immutability [49] Irreversible encryption [51] Pruning [25], [51], [69] Chameleon hash Removing immutability [52] Truncated hash [53] Consensus [54] GDPR amendment Regulation amendment permissionless blockchain. Therefore, an additional solution for data access control for each user is required.…”

“…They propose consent management and access control frameworks that comply with the GDPR principles. Eight articles proposed a consent ontology model briefly [31], [33], [61], [75], [80]- [82], [87]. The proposal aimed to support efficient decision-making on whether data processing behavior is lawful in a blockchain.…”