Decentralized data processing: personal data stores and the GDPR

Abstract

on the protection of natural persons with regard to the processing of personal data and on the free movement of personal data, and repealing Directive 95/46/EC (General Data Protection Regulation) (2016) OJ L119/1. Art 4(1) GDPR defines personal data. Heleen Janssen et al. Á Decentralized data processing

Betraying Blockchain: Accountability, Transparency and Document Standards for Non-Fungible Tokens (NFTs)

“…For instance, blockchain technology in general might have trouble complying with new disclosure laws (i.e., GDPR and CCPA) and something like 'privacy by design' could be necessary. Making use of UX and interface design theories (as outlined in the Users' section) could also aid firms in this task [41].…”

“…Since the decentralization of the blockchain ledger offers protection for Users, it is difficult to negotiate this protection with the necessary information needed to keep the Firms accountable. One possible way forward is to create personal data stores for consumers that could be accessed in an investigation [41]. There are still issues with this idea such as the inability to access this data due to multiple entities being involved, yet it could be studied as a model to prompt the sorting out of what information needs to be on the blockchain and who is responsible for its retention.…”

Personal Information Management Systems

“…Their purported goal is to empower individuals with regards to their personal data (Abiteboul et al, 2015;EDPS, 2016;IAPP, 2019;Royal Society, 2019;Janssen et al, 2020a). Given the discourse around how data is currently being extracted and used, the concept is growing in prominence in the research and commercial space (Janssen et al, 2020b), as well as gaining policy attention (European Commission, 2020).…”

“…where user data are transferred to the third party). Instead, such mechanisms enable the third-party's desired computation, analytics, or other processing to be brought to the user's data (typically residing within a physical or virtual user-centric PIMS device), with only the results of that processing returned to the third-party (Janssen et al, 2020a). This (as with other forms of processing) occurs in line with a user's agreement, and only over certain data, as determined by the user.…”

‘They’re all about pushing the products and shiny things rather than fundamental security’:Mapping socio-technical challenges in securing the smart home

“…The legal consequence of this phenomenon, in the light of the European Court of Justice's jurisprudence, is that end-users and IoT vendors (including manufacturers and service providers) are likely to be held jointly responsible for the processing of personal data by smart devices. Yet, it is unclear how the responsibilities should be allocated in practice to duly reflect their respective control, calling into question whether and how domestic data controllers should be treated differently from commercial controllers, given their weaker position in the market and their lack of necessary skills and resources to manage cybersecurity effectively (Urquhart and Chen, 2020;Janssen et al, 2020). This also raises the question as to how IoT businesses can support end-users to fulfil their data protection duties and to prevent cybersecurity threats, which may arguably form part of those businesses' accountability duty.…”