NFTs: Privacy and Data Protection

If you are on Instagram, chances are you have seen your favourite artists start selling their pieces as NFTs. If you read the newspaper, you will have read about the first tweet selling for millions. If you are more of a long-read enthusiast, you may have read about the environmental impact associated with NFTs. The point is that, where we described the trend around NFTs as fairly inconspicuous in our first blog, the topic is now everywhere. With this surge in popularity, all sorts of questions arise, especially since NFTs do not fit neatly into existing regulatory frameworks, and neither does the blockchain they live on. We have already addressed some of those questions. In our first blog we explained what NFTs are and what you can do with them. In the second we looked at ownership rights. Now we tackle a third topic: privacy and data protection. As NFTs are stored on the blockchain, the information recorded is immutable. Is that compatible with the GDPR? What challenges do NFTs face in terms of data protection law?

Previously, in this season of NFTs: non-fungible tokens are essentially positions on the blockchain connected to objects. They are, for the most part, metadata files which are encoded using a digital file. They are not the digital works they are connected to. That is, when you purchase an NFT from an artist you like, you do not own the actual image. Hypothetically, the artist could create many more NFTs of the same image if they wished. The metadata files contain information about the work they are connected to, and whatever additional information the creator of the NFT wishes to add. You can regard this as a type of receipt, collectible, certificate of authenticity or museum label: a numbered, or sometimes unique, proprietary stamp. That data is then made permanent and unalterable by recording it on the blockchain. If an NFT changes hands, that too is recorded on the blockchain.

This is where problems with the GDPR may arise. Consider, for example, the (in)famous ‘right to be forgotten’ in Article 17: “The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller shall have the obligation to erase personal data without undue delay.”

At first glance the right to be forgotten seems to be entirely incompatible with blockchain. The right to be forgotten is not absolute, however. If it were, that would spell the end of every blockchain storing personal data, which is the vast majority of them. Though there is some debate as to whether an account name counts as personal data, because it may be hard or seemingly impossible to identify an individual from it, it should be treated as such. Not only as a precaution, but also because many account holders will be identifiable (think ‘B_Obama61’, or other accounts that are published, that have even been through KYC checks, or that can be connected to an individual by combining data), which means that under the GDPR all of them have to be treated that way. So yes, more often than not there is personal data stored on the blockchain.

The right to be forgotten takes the purpose of processing into account: if the personal data is no longer needed, it must be deleted following a request to be forgotten. So is the personal data still needed for the purposes for which it has been stored or used on the blockchain? In the case of a blockchain transaction, and therefore of an NFT transaction, public keys, account names and transaction details need to be stored, among other things. The GDPR then lists six legal grounds for processing, and therefore for storage on the blockchain, in Article 6. These are consent, performance of a contract, a legal obligation, protection of vital interests, carrying out a public task, and legitimate interest. Consent and performance of a contract are tricky, because they are generally not eternal or immutable, whereas blockchain is. That is, consent can be withdrawn, and the current view on agreements is that they cannot be eternal. If one clause, on immutability, could live on, then this ground may be applicable. Of the remaining legal grounds, only legitimate interest will currently be relevant for long-term storage (though that may change in the future, if governmental agencies start using blockchain, for instance). This matters, because the right to be forgotten applies once processing no longer has a legal basis.

For NFTs, there are legitimate interests to consider. The continuation of blockchain, which is based on immutability and provides important new digital infrastructure to society. The creation of a novel market in which artists can operate and earn a living in a digital society. Possibly the recording of historic details and important information where the NFT is connected to a real-life object, such as a vintage watch or a house. These interests are significant. They vary from case to case, but they always include the immutability of the blockchain itself, and they have to be weighed against the data subject’s interest in rectification or erasure. The type of information the data subject wishes to change or remove, which may be transaction details, user names, hashes and so on, also has to be taken into account. Note, too, that other users will be affected by a single data subject’s request for either, as it would require a drastic measure (a hard fork), if it is possible at all. Their interests should be taken into account as well.

Article 17(1)(a) goes on to state that the right to be forgotten applies where ‘the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed’. In the case of blockchain, though, immutability is one of its purposes. If there is an NFT, there will be blockchain. If there is blockchain, there has to be immutability. If there is immutability, the personal data cannot cease to be necessary in relation to the purpose, because then it would be mutable.

Though we do not yet know what the outcome of all these balancing exercises will be, it is unlikely that a single data subject’s interest will override the interests of blockchain, its users and the NFT community as a whole. I have written a more in-depth overview on blockchain and GDPR compliance for Europechain, which you can read here.

---

In cooperation with Saar Hoek