The Blockchain Privacy Paradox: Best Practices for Data Management in Crypto | Denton

Blockchains are touted as next-generation databases that promise to facilitate secure and efficient transactions between unknown parties. However, one of the main pillars of a blockchain’s security is the fact that people with access to the blockchain can see the full history of transactions executed on the blockchain – the result being that each party has an equal chance of verify the accuracy of the information stored. . But if all the information stored on the blockchain can be viewed by anyone with access to the blockchain, what happens when that information qualifies as “personal information” under Canadian privacy laws? Organizations that collect, use, or disclose “personal information” are subject to various compliance obligations which, as we explain below, can be difficult to reconcile with certain fundamental principles of blockchain.

What is personal information?

In Gordon vs. Canada, the Federal Court explained that personal information is information that can be used to identify an individual if the information “permits” or “leads” to the possible identification of the individual, whether on the basis of such information alone. information or when the information is combined with other information from other available sources. Therefore, a company that merely “de-identifies” or “pseudonymizes” data may still be subject to the requirements of Canadian privacy law, as it is possible that such data may be “re-identified”. This poses a unique challenge to blockchain infrastructure developers and businesses that operate on top of blockchain infrastructure, when the metadata that is necessarily rooted in blockchain transactions can be re-identifiable. This metadata can constitute personal information when it reveals where transactions originated, to whom they were sent (not necessarily the recipient’s name, but the recipient’s address), how much money was sent, and at what time. .

Take for example decentralized applications (DApps), which are built from software deployed on the blockchain (e.g. smart contracts) that are typically designed to perform business operations for businesses. The operations of smart contracts that effectively facilitate the functionality of DApps are often made public to each node of the blockchain network as “bytecode,” which can be reverse-engineered to reveal the same transactional information as peer-to-peer metadata. . transactions.

So what does it mean if this data, stored and processed on public blockchain networks, is considered personal information? The result is somewhat paradoxical.

Blockchain – the privacy paradox

Immutability

Records posted to a blockchain cannot be deleted, but most modern privacy laws give individuals a “right to be forgotten.” How can an individual or data subject exercise their right to be forgotten when the information recorded on a blockchain register is permanent?

Transparency

The very basis of trust in decentralized networks results from the transparency of the ledger. All participants in public blockchain networks trust the sanctity of information because they can all see and analyze that information equally and in real time. But if all information is transparent, it becomes accessible to everyone and can, theoretically, be used by unknown actors for unknown purposes. Accordingly, how can an entity that leverages blockchain technology to execute transactions and/or store information provide appropriate protections to data subjects as to how their information may be used or disclosed?

Responsibility

Public blockchains are intentionally decentralized so that there is no single responsible entity. Additionally, networks composed through public blockchains often span jurisdictions and can be made up of hundreds, thousands, or millions of people who all technically have the ability to inform updates to the blockchain (a capability similar to managerial decision-making). Under these circumstances, how can a regulator impose actions against proponents of a public blockchain, when responsibilities for maintenance, management, and ongoing development are distributed among a community of unassociated individuals?

Best Practices for Managing Personal Information in the Context of Blockchain

No official recommendations or interpretations on how to handle personal data on public or private blockchains have been published in Canada. However, a broad interpretation of personal information, which is customary under Canadian law, could deter blockchain stakeholders from processing personal data on public blockchains, because data on a blockchain is accessible by anyone with access to it. this blockchain and distributed/stored between all nodes. in the public blockchain network.

In the context of the private blockchain, the management of individual rights to personal information is possible because there are designated and accountable entities that control the number of stakeholders who have access to the blockchain. Under such circumstances, stakeholders may require compliance with privacy regulations as a means of accessing the private blockchain and its associated applications. Stakeholders can also be removed from the network for non-compliance, and a sufficiently centralized private blockchain can be overridden by participants through collaboration to respond to certain privacy-invasive incidents.

Stakeholders behind DApps in public or private blockchain contexts also have the ability to proactively mitigate privacy law risks by designing appropriate privacy policies and implementing best practices that involve :

  • Combine in-string and out-of-string data

The blockchain application should avoid storing personal data as a payload on the blockchain (i.e., including identifying information in the message accompanying the payment itself), and ensure that blockchain transactions serve as simple pointers or as an access control mechanism to more easily managed storage solutions. -chain.

  • Use of privacy-centric technologies and cryptographic methods

Encryption techniques currently used by privacy-centric chains include ZK-SNARKS, Ring Confidential Transactions, and shuffling techniques, all of which aim to hide the identity of the sender or recipient and/or allow participants to confirm the legitimacy of the transaction by cryptographically proving that they know something without revealing the nature and identity of the information.

  • Drive data transformations

Other privacy-enhancing encryption and destruction techniques may be used to protect an individual’s privacy rights, such as data hashing or the application of other data transformation techniques to personal information , and revoking access rights to a blockchain application (or the entire blockchain in a private blockchain network). However, Canadian regulators have not determined whether these measures are sufficient to meet the requirements of Canadian privacy legislation.

Organizations that use blockchain technology to collect, use or disclose personal information must ensure that they stay informed and comply with the requirements of Canadian privacy laws.

  1. Office of the Privacy Commissioner of Canada, Metadata and Privacy: A Technical and Legal Overview (October 2014) at 6↩
  2. Di Filippi, “The Interaction Between Decentralization and Privacy” The Case of Blockchain Technologies” (2016) n. 7 Journal of Peer Production: Alternative Internets 5 (SSRN) to 8. ↩

Comments are closed.