GDPR Compliant Blockchains–A Systematic Literature Review

Abstract

Although blockchain-based digital services promise trust, accountability, and transparency, multiple paradoxes between blockchains and GDPR have been highlighted in the recent literature. Some of the recent literature also proposed possible solutions to these paradoxes. This article aims to conduct a systematic literature review on GDPR compliant blockchains and synthesize the findings. In particular, the goal was to identify 1) the GDPR articles that have been explored in prior literature; 2) the relevant research domains that have been explored, and 3) the research gaps. Our findings synthesized that the blockchains relevant GDPR articles can be categorized into six major groups, namely data deletion and modification (Article 16, 17, and 18), protection by design by default (Article 25), responsibilities of controllers and processors (Article 24, 26, and 28), consent management (Article 7), data processing principles and lawfulness (Article 5,6 and 12), and territorial scope (Article 3). We also found seven research domains where GDPR compliant blockchains have been discussed, which include IoT, financial data, healthcare, personal identity, online data, information governance, and smart city. From our analysis, we have identified a few key research gaps and present a future research direction.

Cybersecurity, Data Privacy and Blockchain: A Review

“…As stated in [ 41 ], BC-based digital services offer transparency, accountability and trust, however not one size fits all, as there are paradoxes between cybersecurity, GDPR compliance and the operation of BC. Haque et al, demonstrate in a systematic literature review regarding GDPR-BC compliance and highlights six major categories that are: Data modification and deletion (Articles 16–18) Default protection by design (Article 25) Controllers/processors responsibilities (Articles 24, 26 and 28) Consent management (Article 7) Lawfulness and principles (Articles 5, 6 and 12) Territorial scope (Article 3) Haque et al [ 41 ] states that use-cases of BC should be retrospectively applied in a way that can be made compliant to GDPR. The literature review also highlighted additional GDPR-BC research domains that include areas such as smart cities, information governance, healthcare, financial data and personal identity.…”

Yes, I Do: Marrying Blockchain Applications with GDPR

“…Both the right to rectification and the right to erasure of personal data are generally considered the most challenging issues in promoting blockchain use cases [33]. In addition, Haque et al [6] outline conflicts regarding responsibilities of controllers and processors (see Art. 24, 26, 28, GDPR), as well as the technology's territorial scope (see Art.…”

“…Saglam et al [5] demonstrate that more than two thirds of blockchain projects do not communicate about GDPR at all. Consequently, Haque et al [6] point out the necessity of further investigating how blockchain solutions can comply with privacy by design.…”

Towards a GDPR-Compliant Blockchain-Based COVID Vaccination Passport

“…The proposed vaccination passport is intended for the EU region, therefore, GDPR compliance issues are imperative to be considered [32,33]. Among all the compliance issues, data deletion, modification, defining the controller and processor are the most crucial ones.…”