Blockchain and the controller under the GDPR: finding a necessary balance for BC to become a mainstream infrastructure

Blockchain was obviously not the focus of the people who drafted the GDPR. It simply wasn’t there yet. The GDPR is written with some sort of central control in mind. That is not how blockchain is supposed to work. The consequences of that, and the way Europechain deals with them, are set out in this blog post.

One can give many rights to a person, but without knowing against whom he or she may invoke them, rights do not mean anything. That is why the GDPR introduces the “data controller”. That is the person to whom individuals can turn. A GDPR “data controller” basically controls the data. It determines the “what” and the “how” of the use of the data. For example, if a company stores and uses data to communicate with its clients, that company “controls” that use and is the controller. If a controller hires other parties to help it with the processing, those hired hands are called “data processors”. “Use”, “store” and many other actions regarding data are called “processing” in the GDPR.

How does this work with blockchain? If a company uses blockchain to run software (dApps) on it, that company is the controller for the data that that dApp processes. Is the blockchain the hired hand? The “data processor”? There is no contract between the dApp and the “blockchain”. The blockchain is not an entity but software run decentrally. Nodes are often not known. The company just launches the dApp. So it is unclear. Yet the blockchain is not a controller: it just performs instructions from the dApp.

And what about the data the blockchain processes without a dApp? Processing such as transferring tokens and storing transactions? The blockchain would have to be the data controller. But the blockchain is not an entity. In that event, are all the nodes controllers? But they do not “control”. They just mine. How could they be controllers? Blockchain is made not to have control.

A safe conclusion, therefore, is that it is impossible for a public permissionless blockchain to establish or even determine the controller and the processor. For this reason alone, such a blockchain can never be GDPR compliant.

A GDPR compliant public blockchain is possible, but it needs some form of centralisation and control. There has to be an entity that people can turn to with their questions and demands. This entity also needs to ensure that sensitive personal data is not stored on chain. It needs enough powers to ensure GDPR compatibility, but not so many that it could tamper with the blockchain’s immutability and threaten the very core of blockchain technology.

There are many blockchains that have central entities involved. Often a foundation that decides on code upgrades, for instance. Or that sets up some sort of conflict resolution, or decides on funding. It is possible to give that entity enough controlling powers to make it the controller, provided the software and the concrete setup allow for that.

I am, as Chief Legal Officer (CLO), involved with Europechain, a blockchain built on EOS.IO DPOS software. We believe Europechain to be an example of a setup that is compatible in this respect.

As everywhere else, with Europechain the dApps are the data controllers. They must conclude a processing agreement with the limited liability company Europechain B.V., which will be the data processor. Before dApps are allowed on chain, they will have to prove that they will not store sensitive data on chain.

Europechain B.V. concludes sub-processor agreements with all the nodes (the block producers). Without concluding a (sub)processor agreement, a party cannot run a dApp or become a node. If there is no dApp, for example in the event of token transfers on the base layer, Europechain B.V. is the controller. In that event the nodes are not sub-processors but processors. The agreements are drafted so as to allow for that. They contain dispute resolution clauses, so that the powers of Europechain B.V. are kept in check and the nodes can easily be required to comply with Europechain B.V.’s instructions.

This setup allows for enough control to ensure that people are informed and are able to submit their requests to a competent entity. It also provides the contractual infrastructure required under the GDPR. Given that the powers Europechain B.V. has are tailored to its position as a data controller, which is basically to apply the law that is already there, and given that they are kept in check by the dispute resolution system, there is no way Europechain B.V.’s position could endanger the core values of the blockchain.

Europechain’s setup proves it is possible to find the right balance. A balance that is necessary for blockchain to become a mainstream infrastructure.

Amsterdam, 15 September 2019