blockchain technology is the most transparent
Blockchain technology is on a collision course with EU privacy law
41–46 of 46 posts
Re: Blockchain technology is on a collision course with EU privacy law
#42Earlier quoted context omitted.
That is a simple problem to solve. You encrypt all data stored on the blockchain. You have the private key to your encrypted personal data on the blockchain. You can share this key with private corporations who want to use your data. In order to invoke your "right to be forgotten", you just ask the 3rd party to delete any record of your private key. Now they can't access your data. Simple.
What if the cryptography gets broken? Who's responsible then?
What if a bad actor hacks a centralized database? Which is more likely?
Re: Blockchain technology is on a collision course with EU privacy law
#431. Encrypt your personal data with a private key that you control. 2. Put encrypted personal data on a blockchain. 3. When a 3rd party wants to use your data, give them your private key. They can store this in their own database so that they can access your blockchain data whenever they wish. 4. To invoke your "right to be forgotten", simply ask the 3rd party to delete your private key. Am I missing something?
This is cryptoshredding, more or less. There are a couple of wrinkles to your good idea. * It potentially makes updates complicated. * In the event of a key compromise, you're forever hosed. * You probably shouldn't hand out your private key like that. * They wouldn't need your private key to read the data you've described, requiring your public key instead. * You have no ability to revoke someone's access - grant it…
Thanks for the thoughtful response.
Ok, what about this: Only you have your private key, which must be used to modify the data, everyone else is given a "view key", which is read-only. If at any point a view key is compromised, you can somehow revoke the view key using the private key. Would that not work?
Re: Blockchain technology is on a collision course with EU privacy law
#44Definitely it was a good read, but let me just focus on the main point. It is true that Blockchain technology has been thought as a replacement of a trusted third party like a notary or central register, but usually those are public registries: household ownerships, public offers... And those registries are usually exceptions or are treated in a different way (and usually they are explicitly regulated by each country…
Even in case of mortgages, you need to be prepared for requests. At least where I live, it's legally allowed to remove all information about a loan once you paid the entire cost of it.
I am not an expert on Spanish regulation, but I can tell you that sometimes the regulator oblige enterprises to store this records for long times (eventually it will expire).
Public records are store forever (unless broken)... =), at least, up to date.
Re: Blockchain technology is on a collision course with EU privacy law
#45one drunken night you decide to put some random piece of private information on the bitcoin/etherum blockchain. can you invoke your "right to be forgotten"? if so, can you c&d every node in the EU to take down your info?
That would be completely your own fault. Drinking and banking is risky too, or drinking and driving. Make it a best practice to only interact with blockchain systems when sober. Not a very strange idea IMO.
Re: Blockchain technology is on a collision course with EU privacy law
#46Earlier quoted context omitted.
This is cryptoshredding, more or less. There are a couple of wrinkles to your good idea. * It potentially makes updates complicated. * In the event of a key compromise, you're forever hosed. * You probably shouldn't hand out your private key like that. * They wouldn't need your private key to read the data you've described, requiring your public key instead. * You have no ability to revoke someone's access - grant it…
Thanks for the thoughtful response. Ok, what about this: Only you have your private key, which must be used to modify the data, everyone else is given a "view key", which is read-only. If at any point a view key is compromised, you can somehow revoke the view key using the private key. Would that not work?
Thanks for humoring me!
It sounds a lot like you're trying to re-invent PKI and mutable data stores. Are you sure that isn't what you want here?