Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Blockchain technology is on a collision course with EU privacy law

iapp.org

Post reply on HN
Print view View original

31–40 of 46 posts

Re: Blockchain technology is on a collision course with EU privacy law

#31

Post by geocar »

BjoernKW wrote: post #20
geocar wrote: post #13

Earlier quoted context omitted.

> If followed to the letter GDPR would've major repercussions on tax regulations because as a company you're legally bound to keep accounting records for at least 10 years whereas according to GDPR you're required to delete any record if asked by a person whose personal data appears in that record. http://www.privacy-regulation.eu/en/recital-65-GDPR.htm False. You're allowed to retain the data where it is necessary t…

That‘s exactly what I said. For instance, you have to retain accounting records such as invoices even if the invoice recipient asks you to delete the personal data on that invoice. Anything else would open up new avenues for tax fraud.

You are allowed to ignore (refuse) to delete personal data from the Invoice: You may need their name to file suit against them for refusing to pay the invoice.

Re: Blockchain technology is on a collision course with EU privacy law

#32

Post by fastball »

cjbprime wrote: post #28
antsykarbo wrote: post #15

Clickbaity headline. It's not the "blockchain technology" as a whole, but some specific use of it that can potentially violate the GDPR. You don't need a blockchain to violate the law: you can do it with paper or mysql or usb keys. Bottom line is: don't put your customers' personal data onto anything that you don't control. Nothing to see here.

I don't think it's clickbaity. There is a legitimate conflict in goals between this legislation and the increasingly popular use of public blockchains to store personal data. You don't need a public blockchain to violate the law, but it's hard to have a public blockchain without violating this law, if you use that blockchain to store personal data.

That is a simple problem to solve.

You encrypt all data stored on the blockchain. You have the private key to your encrypted personal data on the blockchain. You can share this key with private corporations who want to use your data. In order to invoke your "right to be forgotten", you just ask the 3rd party to delete any record of your private key. Now they can't access your data. Simple.

Re: Blockchain technology is on a collision course with EU privacy law

#33

Post by vertex-four »

GlitchMr wrote: post #25
dullgiulio wrote: post #6

Earlier quoted context omitted.

Not just a public blockchain, any blockchain. Say an employee leaves, they should have the right to have records removed. The internal Enterprise Blockchain doesn't allow that. But because of hype, every big company has to have some sort of blockchain somewhere, for no good reason. The EU will get a lot of bad publicity while actually doing something very reasonable.

Huh? If that was the case, it would go a bit too far, as it would make technologies like e-mail or git illegal to use internally, considering those are likely to have a real name of a person who sent an e-mail/committed.

Git history can be modified, as can email headers, but yeah - the law is more about e.g. disciplinary records, stuff stored on your section of the company file server, and other things which the company really has no legitimate use for once you’ve left.

In practice, the best solution to this is for companies to check over their data retention policies and making sure they’re not holding on to data for longer than they need to - which may involve creating processes to take information out of emails and put it somewhere more structured/permanent - rather than being blindsided with a request without the infrastructure to handle it. The best response, after all, is “we deleted/modified that data so as to comply with your request already”, rather than “we’ll be back to you once we’ve read through your 50,000 emails and decided which ones we need to keep”.

Re: Blockchain technology is on a collision course with EU privacy law

#34

Post by fastball »

1. Encrypt your personal data with a private key that you control.

2. Put encrypted personal data on a blockchain.

3. When a 3rd party wants to use your data, give them your private key. They can store this in their own database so that they can access your blockchain data whenever they wish.

4. To invoke your "right to be forgotten", simply ask the 3rd party to delete your private key.

Am I missing something?

Re: Blockchain technology is on a collision course with EU privacy law

#35

Post by Kalium »

fastball wrote: post #34

1. Encrypt your personal data with a private key that you control. 2. Put encrypted personal data on a blockchain. 3. When a 3rd party wants to use your data, give them your private key. They can store this in their own database so that they can access your blockchain data whenever they wish. 4. To invoke your "right to be forgotten", simply ask the 3rd party to delete your private key. Am I missing something?

This is cryptoshredding, more or less. There are a couple of wrinkles to your good idea.

* It potentially makes updates complicated.

* In the event of a key compromise, you're forever hosed.

* You probably shouldn't hand out your private key like that.

* They wouldn't need your private key to read the data you've described, requiring your public key instead.

* You have no ability to revoke someone's access - grant it once and it's eternal.

It's a good start! Cryptography is very powerful and can do a lot to solve this problem. Thank you so much for caring and putting forward an interesting idea.

Re: Blockchain technology is on a collision course with EU privacy law

#36

Post by marknadal »

GlitchMr wrote: post #21

Well, yeah, there is a rather straightforward solution - just don't store any personal information on a blockchain. Is it practical? Sometimes yes. Some usecases won't be able to do that, and this is fine, they should just consider technologies other than a blockchain. Or if they really want to have blockchain, perhaps consider storing personal information in an external database with references to its fields on a bl…

Yes, I wish more people followed your advice... for anything, not just blockchain.

If you don't want your personal information leaked, never post it anywhere, blockchain or not.

Now, unfortunately, as you comment, this isn't necessarily always practical. So what do we do about that?

Well, ugh! This is why buzzwords of "blockchain" like this article is trying to cash in on, are annoying.

A blockchain does NOT have to be an immutable ledger, all a blockchain has to be is cryptographically signed/linked data. Sure, Bitcoin uses a blockchain that is computationally difficult to rewrite, and therefore for all practical purposes immutable, but it also isn't scalable for storing everybody's personal information.

Instead, you can store people's personal information in a blockchain, and since they are the cryptographic holders of that key, they can null out their data if they want!

This will actually make it easier to comply with the laws they reference, not harder, because people are self-sovereign over their own data and identity.

In fact, we've already implemented a system like this, check it out at https://hackernoon.com/so-you-want-to-build-a-p2p-twitter-wi... .

Re: Blockchain technology is on a collision course with EU privacy law

#37

Post by KaiserPro »

Well yes and no.

The prevention of fraud countermands GDPR, so keeping the financial transactions of anonymous IDs in a public, reasonbly immutable format, is not going to be a problem, infact its going to be encouraged, because data portability is also another key feature of GDPR.

Storing people's personal pictures, well then yes, you have a problem. But then its a stupid place to keep private, non-public interest photos.

Re: Blockchain technology is on a collision course with EU privacy law

#38

Post by neltnerb »

Kalium wrote: post #35
fastball wrote: post #34

1. Encrypt your personal data with a private key that you control. 2. Put encrypted personal data on a blockchain. 3. When a 3rd party wants to use your data, give them your private key. They can store this in their own database so that they can access your blockchain data whenever they wish. 4. To invoke your "right to be forgotten", simply ask the 3rd party to delete your private key. Am I missing something?

This is cryptoshredding, more or less. There are a couple of wrinkles to your good idea. * It potentially makes updates complicated. * In the event of a key compromise, you're forever hosed. * You probably shouldn't hand out your private key like that. * They wouldn't need your private key to read the data you've described, requiring your public key instead. * You have no ability to revoke someone's access - grant it…

How about if the owner of the blockchain (here I'm assuming, say, a land-ownership database run by the state) have a private key for each person in their own system which they use to put the relevant data into a blockchain. Then they delete the private key for that person to scramble entries that need deleting so no one can ever access it again. The person doesn't need to have or know their own private key since it's a backend for the municipal service.

Now why anyone would want to do this with a blockchain instead of a simple encrypted database... well, maybe someone else can explain that. I'm still assuming you visit deeds.mass.gov or something and have an interface you would use to find out who owns what, so the end user isn't actually touching the blockchain in this case.

Re: Blockchain technology is on a collision course with EU privacy law

#39

Post by Kalium »

neltnerb wrote: post #38
Kalium wrote: post #35

Earlier quoted context omitted.

This is cryptoshredding, more or less. There are a couple of wrinkles to your good idea. * It potentially makes updates complicated. * In the event of a key compromise, you're forever hosed. * You probably shouldn't hand out your private key like that. * They wouldn't need your private key to read the data you've described, requiring your public key instead. * You have no ability to revoke someone's access - grant it…

How about if the owner of the blockchain (here I'm assuming, say, a land-ownership database run by the state) have a private key for each person in their own system which they use to put the relevant data into a blockchain. Then they delete the private key for that person to scramble entries that need deleting so no one can ever access it again. The person doesn't need to have or know their own private key since it's…

As I understand PKI, and my understanding is limited so I could of course be very wrong, but in the scenario you describe the deletion of the private key would do nothing to prevent people from decrypting data readable with a public key.

This would work with a symmetric key! But as you say, I'm struggling to think of any real advantages to using a blockchain here.

Re: Blockchain technology is on a collision course with EU privacy law

#40

Post by Fnoord »

fastball wrote: post #32
cjbprime wrote: post #28

Earlier quoted context omitted.

I don't think it's clickbaity. There is a legitimate conflict in goals between this legislation and the increasingly popular use of public blockchains to store personal data. You don't need a public blockchain to violate the law, but it's hard to have a public blockchain without violating this law, if you use that blockchain to store personal data.

That is a simple problem to solve. You encrypt all data stored on the blockchain. You have the private key to your encrypted personal data on the blockchain. You can share this key with private corporations who want to use your data. In order to invoke your "right to be forgotten", you just ask the 3rd party to delete any record of your private key. Now they can't access your data. Simple.

What if the cryptography gets broken? Who's responsible then?
Post reply on HN