Yes, I Do: Marrying Blockchain Applications with GDPR

Abstract

Due to blockchains' intrinsic transparency and immutability, blockchain-based applications are challenged by privacy regulations, such as the EU General Data Protection Regulation. Hence, scaling blockchain use cases to production often fails to owe to a lack of compliance with legal constraints. As current research mainly focuses on specific use cases, we aim to offer comprehensive guidance regarding the development of blockchain solutions that comply with privacy regulations. Following the action design research method, we contribute a generic framework and design principles to the research domain. In this context, we also emphasize the need for distinguishing between applications based on blockchains' data integrity and computational integrity guarantees.

The transparency challenge of blockchain in organizations

“…In many applications, the disclosure of data to other blockchain nodes by default often conflicts with companies' data policies, customers' expectations, and antitrust and data protection regulations, and specifically with the GDPR's "right to be forgotten" (Schellinger et al, 2021). While individuals can agree with the processing and sharing of their data, they can demand deletion at a later stage according to the GDPR.…”

“…In this context, Kannengießer et al (2020), for instance, have already contributed to a more detailed understanding of the related trade-offs from a technical perspective. Yet, we found that transparency-related discussions are often restricted to personal information and the GDPR's right to be forgotten (Schellinger et al, 2021) or not considered a substantial challenge (e.g., Lacity & Van Hoek, 2021). Some researchers even consider blockchain as a suitable technology to increase privacy (e.g., see the overview in Karger, 2020).…”

Enabling end-to-end digital carbon emission tracing with shielded NFTs

“…However, transparency in this context is a two-sided sword: Information on a businesses' CO 2 emissions can be problematic because it constitutes sensitive business data that may allow competitors to infer information that they should not get access to or even conflict with antitrust regulation (Sedlmeir et al 2022;Schellinger et al 2022). In a downstream approach, CO 2 emission data could even become personally identifiable and, thus, conflict with data protection regulation and end users' privacy requirements.…”

“…Another dimension for comparing such proposals is whether the carbon emission tokens are non-distinguishable (fungible) or distinguishable (non-fungible). Most of the related work focuses on non-fungibility since it enables the traceability and verifiability of CO 2 tokens according to their origin, but the uniqueness of the tokens and transactions increases the ability to attribute stakeholders to their pseudonymous wallet addresses on a public blockchain ledger and is, hence, problematic both from the perspective of organizations and individuals (Sedlmeir et al 2022;Biryukov et al 2014;Schellinger et al 2022). On the other hand, privacy-oriented, blockchain-based solutions, such as Sasson et al (2014), or solutions that adapt similar approaches in energyrelated use cases (Baza et al 2021), require that tokens are indistinguishable (fungible) to make transactions unlinkable (Pfitzmann and Hansen 2010), compromising the ability to trace and differentiate different emission sources or to hold stakeholders accountable for malicious behaviour.…”

A systematic literature review on sensitive data protection in blockchain applications

“…According to Stephan, this problem of translational security could be resolved using Elliptic Curve Diffie-Hellman-Merkle (ECDHM). 122 Concern regarding the identity is continually reported by researchers. 123 A plethora of questions has been raised in this regard viz.…”