Blockchain and the right to be forgotten

Are blockchain and EU privacy law a bad match? One might think so. Is EU privacy law not all about the right to be forgotten? About being erased from a system you want to break free from? And is it not impossible to be forgotten once your data is on a blockchain? So is blockchain, in this respect, not always completely incompatible with EU law?

The short answer is no.

The right to be forgotten is not an absolute right. What matters here is that a person has the right to be forgotten, and the data must be deleted, only where keeping that data no longer serves the purpose for which it was stored. Data integrity, the very reason blockchain came into existence, is such a purpose, and one could therefore argue that storing the data is necessary to serve that purpose.

Does that mean that anything goes on the blockchain? That the integrity of the chain always overrides the right to be forgotten?

Again, the short answer is no.

EU law is all about data minimisation. In essence, the right to be forgotten is a species of the general rule that one should use as little personal data as possible. You also need a legal basis on which you may process that data. In this case that basis has to be the legitimate interest of the controller. That interest, however, must always be weighed against the right to privacy of the people concerned. If you store too much data on the blockchain, that will be contrary to EU law, because both criteria then fall away: no data minimisation and no legal basis.

App developers and blockchain providers should therefore always abide by a few essential rules:

1. do not store the data on chain, only the hash (zero-knowledge proof);
2. store as little data on the blockchain as possible;
3. do not store data that directly identifies a person, such as personal identification numbers or pictures;
4. make sure the data stored can be separated from the person (authentication offline).

If app developers follow these rules, blockchain could even improve data protection. If they do not, EU bodies may well move against them, which could endanger the entire chain. Bear in mind that the right to be forgotten is just one of the rights a data subject has. And becoming and remaining compliant takes more than being able to grant those rights. Given the natural tension between blockchain and the right to be forgotten, though, I thought it wise to clarify this issue first.

Looking forward to your comments!