ABSTRACT

Permacrisis has also reached the doorstep of European Union (EU) personal data law. It is no surprise that this has prompted a major reevaluation of significant normative issues in the field. The primary challenge lies in the rapid growth of advanced technologies, such as blockchain. This raises the first question: “What is a blockchain?” A collection of permanent records linked together and highly resistant to alteration. In other words, a 21st-century revolution which repeatedly tests traditional frameworks such as the General Data Protection Regulation (GDPR). The GDPR’s ’right to be forgotten’ principle, which allows data subjects to request the deletion of their personal data, conflicts with the immutable nature of blockchain. Furthermore, the integration of blockchain into existing legal systems raises issues of compatibility and effectiveness. This paper discusses the conflict by examining several examples from EU member states, beginning with the Berlin-based company BigchainDB’s initiative and extending to Italy’s challenges in reconciling GDPR principles with new sector-specific requirements. Finally, it offers multi-faceted approaches necessary to address the significant challenges posed by blockchain.

KEYWORDS

blockchain law | decentralized technology| EU law | European Union | personal data | permacrisis | tech innovators | legal experts | General Data Protection Regulation | right to be forgotten

BIBLIOGRAPHY

Bashir, Imran (2022): Mastering blockchain. A technical reference guide to the inner workings of blockchain, from cryptography to DeFi and NFTs. 4th Edition. Packt Publishing Ltd., Birmingham, United Kingdom. ISBN: 1803241063,9781803241067.

Bernal, Paul (2018): The Internet, Warts and All: Free Speech, Privacy, and Truth. Cambridge University Press, Cambridge.
DOI: https://doi.org/10.1017/9781108381161.002.

BigchainDB: BigchainDB Whitepaper, 2020. (Available at: https://www.bigchaindb.com/whitepaper/bigchaindb-whitepaper.pdf. Accessed on: 26 January, 2025).

BigchainDB: BigchainDB 2.0: The Blockchain Database, 2020. (Available at: https://www.bigchaindb.com/. Accessed on: 26 January, 2025).

Case C-311/18. Data Protection Commissioner v Facebook Ireland Limited and Maximillian Schrem. Judgment of the Court (Grand Chamber) of 16 July 2020, ECLI:EU:C:2020:559. (Available at: https://curia.europa.eu/juris/liste.jsf?num=C-311/18. Accessed on: 26 January, 2025).

CJEU: Google Spain v. Agencia Española de Protección de Datos (AEPD), 2014. Case C-131/12. (Available at:  https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex:62012CJ0131. Accessed on: 26 January, 2025).

EU Blockchain Observatory and Forum: Blockchain and the GDPR. European Commission.

European Blockchain Partnership (2018): Declaration on European Partnership on Blockchain. (Available at: https://digital-strategy.ec.europa.eu/en/news/european-countries-join-blockchain-partnership.  Accessed on: 26 January, 2025).

Finck, Michéle (2018): Blockchain Regulation and Governance in Europe. Blockchains and the General Data Protection Regulation. Cambidge University Press, Cambridge.
DOI: https://doi.org/10.1017/9781108609708.

Garante per la Protezione dei Dati Personali: Annual Report on Emerging Technologies, 2021. (Available at: https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9906288. Accessed on: 26 January, 2025).

General data protection regulation. Regulation (EU), 679. (Available at: https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng. (Accessed on: 26 January, 2025).

Greenleaf, Graham (2021): Global data privacy laws 2021: Despite COVID delays, 145 laws show GDPR dominance. In: Privacy Laws & Business International Report.  (Available at: https://papers.ssrn.com/sol3/papers.cfm?abstract_id=3836348. Accessed on: 26 January, 2025).
DOI: https://doi.org/10.2139/ssrn.3836348.

Hong, Seong-Ho – Kim, Heeyoul (2020): Vaultpoint: A blockchain-based SSI model that complies with OAuth 2.0. In: Electronics. 9(8) (Available at: https://www.mdpi.com/2079-9292/9/8/1231. Accessed on: 26 January, 2025).
DOI: https://doi.org/10.3390/electronics9081231.

Kuner, Christopher (2012): The European Commission’s proposed Data Protection Regulation: A Copernican revolution in European data protection law. In: Bloomberg BNA Privacy and Security Law Report. 11(6). (Available at:  https://news.bloomberglaw.com/tech-and-telecom-law/the-european-commissions-proposed-data-protection-regulation-a-copernican-revolution-in-european-data-protection-law-1. Accessed on: 26 January, 2025).

Li, Xiaoqi – Jiang, Peng – Chen, Ting et al. (2017): A Survey on the Security of Blockchain Systems. In: Future Generation Computer Systems. 107(2017).
DOI: https://doi.org/ 10.1016/j.future.2017.08.020.

Lloyd, Ian J. (2020): Information Technology Law. 9th ed., Oxford University Press, Oxford.
DOI: https://doi.org/10.1093/he/9780198787556.001.0001.

Lopes, Dayani Christina Ferreira – de Castro, André Luis – Russo, Letíca Xander (2024): Blockchain technology: Challenges and opportunities in public finance. In: RAM. Revista de Administração Mackenzie. 25(3). eRAMR240208. (Available at: https://www.scielo.br/j/ram/a/sn7fFDhmqpWWP7BKHzRqtXn/?format=pdf&lang=en. Accessed on: 26 January, 2025).
DOI: https://doi.org/10.1590/1678-6971/eramr240208.

McConaghy, Trent – Marques, Rodolphe – Müller, Andreas – De Jonghe, Dimitri – McConaghy, Troy T. – McMullen, Greg – Henderson, Ryan – Bellemare, Sylvain – Granzotto, Alberto (2016): BigchainDB: A scalable blockchain database. White Paper. (Available at: https://gamma.bigchaindb.com/whitepaper/bigchaindb-whitepaper.pdf. (Accessed on: 26 January, 2025).

Mentasti, Enrico (2020): Digital Identity in Italy: challenges and opportunities for the adoption in banking, insurance and utility sectors. In: POLITesi - Archivio digitale delle tesi di laurea e di dottorato. (Available at: https://www.politesi.polimi.it/retrieve/36b1ca60-893f-4071-83e9-6123d1a0ca42/2022_Giugno_Mentasti.pdf. Accessed on: 26 January, 2025).

Nakamoto, Satoshi (2009): Bitcoin: A Peer-to-Peer Electronic Cash System.  (Available at: https://bitcoin.org/bitcoin.pdf. Accessed on: 26 January, 2025).

Reed, Chris (2012). Making Laws for Cyberspace. Oxford University Press, Oxford.

Rosen, Jeffrey (2012): The Right to be Forgotten. In: Stanford Law Review Online. 64(2012). A(vailable at: https://review.law.stanford.edu/wp-content/uploads/sites/3/2012/02/64-SLRO-88.pdf. Accessed on: 26 January, 2025).

Szostek, Dariusz (2019): Blockchain and the Law. Nomos Verlagsgesellschaft, Baden-Baden. Available at: https://opus.us.edu.pl/info/book/USL53e046269db64d1c8ebe41f47aad0595/ . Accessed on: 26 January, 2025).
DOI: https://doi.org/10.5771/9783845298290.

Torress, Aura Cristina (2018): Service Design and Blockchain For Digital ID. Product Service System Design MSC AA. 2017/2018.

Voigt, Paul – von dem Bussche, Axel (2017): The EU General Data Protection Regulation (GDPR). A Practical Guide. 1st ed.. Springer International Publishing, Cham.
DOI: https://doi.org/10.3152676 (2017): 10-5555.

Weber, Rolf H. – Staiger, Dominic N. (2020): Enforcing privacy through individual data access rights: A comparative study. In: Koltay, András – Wragg, Paul (eds.): Comparative privacy and defamation. Edward Elgar Publishing, Cheltenham and Camberley, United Kingdom.
DOI: https://doi.org/10.4337/9781788970594.00022.

Weber, Rolf H. (2011): The Right to be Forgotten: More than a Pandora’s Box? In: Journal of Intellectual Property, Information Technology and E-Commerce Law. 2(2). (Available at: https://www.jipitec.eu/jipitec/article/view/73. Accessed on: 26 January, 2025).

Werbach, Kevin (2018): Blockchain and the New Architecture of Trust. MIT Press, Cambridge, Massachusetts, United States
DOI: https://doi.org/10.7551/mitpress/11449.001.0001.

Yeung, Karen – Lodge, Martin (eds.): Algorithmic regulation. Oxford University Press, Oxford.
DOI: https://doi.org/10.1093/oso/9780198838494.003.0001.

Zavolokina, Liudmila – Ziolkowksi, Rafael – Bauer, Ingrid – Schwabe, Gerhard (2020): Management, Governance and Value Creation in a Blockchain Consortium. In: MIS Quarterly Executive. Vol. 19/2020.
DOI: https://doi.org/10.17705/2msqe.00022.