GDPR and Blockchain: A Clash of Concepts

In this video, Keir Finlow-Bates highlights the fundamental conflict between the European Union’s General Data Protection Regulation (GDPR) and the core principles of blockchain technology.

What is the GDPR?

The GDPR is a regulation designed to protect the privacy of EU citizens. It grants individuals rights over their personal data, including the right to have incorrect data corrected and the right to be forgotten (have their data deleted). These rights work well within the traditional centralized control model of companies and their databases.

Challenge #1: Decentralization

Blockchains are decentralized systems without a single data controller. This makes it difficult for individuals to exercise their GDPR rights because there’s no clear authority to address their requests.

Challenge #2: Immutability

Blockchains are designed to be nearly immutable, meaning data, once written, becomes practically impossible to alter or delete. This conflicts directly with the GDPR’s requirement for data correction and deletion upon request.

The Bottom Line

The GDPR was created with centralized data models in mind, where a single entity controls and can modify the data. This framework clashes with the decentralized and immutable nature of blockchains, making it extremely difficult to achieve compliance.

An Unresolved Issue

As of now, there is no clear resolution to this conflict. While there are discussions and articles exploring the problem, a definitive solution that bridges GDPR principles and blockchain functionality remains elusive.