{"id":5324,"date":"2018-10-08T17:03:21","date_gmt":"2018-10-08T21:03:21","guid":{"rendered":"https:\/\/abovethelaw.com\/?p=515003"},"modified":"2018-10-08T17:03:21","modified_gmt":"2018-10-08T21:03:21","slug":"why-blockchain-and-the-gdpr-collide-over-your-personal-data","status":"publish","type":"post","link":"https:\/\/abovethelaw.com\/legal-innovation-center\/2018\/10\/08\/why-blockchain-and-the-gdpr-collide-over-your-personal-data\/","title":{"rendered":"Why Blockchain And The GDPR Collide Over Your Personal Data"},"content":{"rendered":"

\"\"If you haven\u2019t heard about blockchain technology by now, you probably have not been paying attention. \u00a0Promising to transform everything from currencies to supply-chain management, blockchain (also referred to as distributed ledger technology, or DLT) provides an independent, distributed, secure mechanism to handle and process huge numbers of records in a traceable and verifiable way. That said, data can\u00a0be made up of many different elements, including personally identifiable information (referred to broadly in this article as \u201cpersonal data\u201d). In the march to deploy this technology, however, there are questions that need to be asked regarding personal data that may be uploaded to the blockchain, and how the technology will comply with current U.S. and international data privacy laws. \u00a0Needless to say, the answers are elusive, and more difficult to address than you may think.<\/p>\n

I have written about this technology previously (see here<\/a>, here<\/a>, and here<\/a>), and remain convinced that it will be an effective technology, albeit a legally challenging one. \u00a0Most people understand the blockchain in the context of cryptocurrency (like Bitcoin), but the technology can operate to power private, permissioned blockchain applications as well. \u00a0 It seems that technology evolves faster than the law can catch up, and blockchain is no exception in this regard. \u00a0When it comes to data privacy law and your personal data, the technology represents the proverbial round peg that does not fit squarely within the four corners of the law (yet).<\/p>\n

On its face, blockchain technology seems a great fit for the privacy of personal data. \u00a0First, blockchain technology uses encryption to secure and verify\u00a0data within the chain, but this is a two-way authentication technology (generally using a public key and private key) that could permit the decryption of personal data if someone else obtain the private key. \u00a0What makes the blockchain even more powerful is that it uses hashes —\u00a0<\/em>one-way functions that can take input of various lengths to create an output of fixed length that can act as a sort of digital fingerprint. \u00a0Without getting too detailed, hash functions are used to \u201chash\u201d data into each block, and subsequent blocks incorporate the previous hash to verify the chain and add the new data. Any change to the data in the block would change the hash for that block and all the subsequent ones in the blockchain. When it comes to data privacy, these characteristics are a big plus, but when it comes to other characteristics of the blockchain, not so much.<\/p>\n

For one, blockchain records are immutable — once a record is added, it is designed to remain unchanged. \u00a0This is at odds with requirements of the General Data Protection Regulation (GDPR) in the EU. \u00a0The GDPR requires that personal data of a \u201cdata subject\u201d be changed or removed if the data subject so requests (sometimes referred to as the \u201cright to be forgotten\u201d). \u00a0Further, California\u2019s recently enacted Consumer Protection Act (CCPA) seems to have taken a cue from the GDPR by providing \u201cconsumers\u201d the right to have their \u201cpersonal information\u201d deleted under Cal. Civil Code \u00a7 1798.105. Blockchain applications that seek to incorporate personal data within the blockchain will need to address this conundrum, such as by \u201cforking\u201d to a new chain (not really a viable long-term solution, IMHO), using mutable \u201cside chains\u201d (which deflates one of the powerful features of blockchain), or otherwise placing such personal data outside the blockchain (which, some would argue, starts defeating the purpose of using a blockchain in the first place).<\/p>\n

Further, the blockchain is highly distributed by design, creating some interesting jurisdictional issues. Whether public or private, a blockchain is made up of many, many<\/em>, different nodes, Does each node need to be GDPR compliant? If so, who is responsible for ensuring each node is GDPR-compliant? In the event of a personal data breach, what is the appropriate jurisdiction and applicable law? Just to make things more complicated, how will EU regulators view (and answer) such issues? These are compelling questions with elusive answers, but answers will be required.\u00a0 The penalties for non-compliance with the GDPR are up to \u20ac20 million or four (4) percent of gross annual turnover, whichever is greater (and yes, you read that correctly).<\/p>\n

Notwithstanding the foregoing, I don\u2019t believe that these questions will remain unanswered, as blockchain has arrived and is only getting started.\u00a0 The pros of the technology are far outweighing the cons at this point. That said, the answers will be challenging, and will push both blockchain technology development as well as the law. Given the recent passage of the CCPA (becoming effective in January of 2020), there is now a push for national data privacy regulation in the U.S. (as the prospect of reconciling multiple state data privacy law statutes has definitely gotten everybody\u2019s attention). Whether that will happen or not is yet to be seen, but something tells me that when it comes to the GPDR (and other U.S. state and federal statues) and blockchain, the party is just getting started.<\/p>\n

\n

\"\"Tom Kulik is an Intellectual Property & Information Technology Partner at the Dallas-based law firm of Scheef & Stone, LLP<\/a>. In private practice for over 20 years, Tom is a sought-after technology lawyer who uses his industry experience as a former computer systems engineer to creatively counsel and help his clients navigate the complexities of law and technology in their business. News outlets reach out to Tom for his insight, and he has been quoted by national media organizations. Get in touch with Tom on Twitter (@LegalIntangibls<\/a>) or Facebook (www.facebook.com\/technologylawyer<\/a>), or contact him directly at tom.kulik@solidcounsel.com<\/a>.<\/em><\/strong><\/p>\n","protected":false},"excerpt":{"rendered":"

When it comes to data privacy law and your personal data, blockchain technology represents the proverbial round peg that does not fit squarely within the four corners of the law.<\/p>\n","protected":false},"author":57534,"featured_media":495713,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[11],"tags":[148,72,79,7,240],"class_list":["post-5324","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-technology","tag-blockchain","tag-gdpr","tag-privacy","tag-technology","tag-tom-kulik"],"acf":[],"yoast_head":"\nWhy Blockchain And The GDPR Collide Over Your Personal Data - Above The Law's Legal Tech Non-Event<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/abovethelaw.com\/legal-innovation-center\/2018\/10\/08\/why-blockchain-and-the-gdpr-collide-over-your-personal-data\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Why Blockchain And The GDPR Collide Over Your Personal Data - Above The Law's Legal Tech Non-Event\" \/>\n<meta property=\"og:description\" content=\"When it comes to data privacy law and your personal data, blockchain technology represents the proverbial round peg that does not fit squarely within the four corners of the law.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/abovethelaw.com\/legal-innovation-center\/2018\/10\/08\/why-blockchain-and-the-gdpr-collide-over-your-personal-data\/\" \/>\n<meta property=\"og:site_name\" content=\"Above The Law's Legal Tech Non-Event\" \/>\n<meta property=\"article:published_time\" content=\"2018-10-08T21:03:21+00:00\" \/>\n<meta name=\"author\" content=\"Tom Kulik\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Tom Kulik\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"5 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/abovethelaw.com\/legal-innovation-center\/2018\/10\/08\/why-blockchain-and-the-gdpr-collide-over-your-personal-data\/\",\"url\":\"https:\/\/abovethelaw.com\/legal-innovation-center\/2018\/10\/08\/why-blockchain-and-the-gdpr-collide-over-your-personal-data\/\",\"name\":\"Why Blockchain And The GDPR Collide Over Your Personal Data - Above The Law's Legal Tech Non-Event\",\"isPartOf\":{\"@id\":\"https:\/\/abovethelaw.com\/legal-innovation-center\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/abovethelaw.com\/legal-innovation-center\/2018\/10\/08\/why-blockchain-and-the-gdpr-collide-over-your-personal-data\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/abovethelaw.com\/legal-innovation-center\/2018\/10\/08\/why-blockchain-and-the-gdpr-collide-over-your-personal-data\/#primaryimage\"},\"thumbnailUrl\":\"\",\"datePublished\":\"2018-10-08T21:03:21+00:00\",\"dateModified\":\"2018-10-08T21:03:21+00:00\",\"author\":{\"@id\":\"https:\/\/abovethelaw.com\/legal-innovation-center\/#\/schema\/person\/5fe0e6ed2a9f76d7b23328c476efb962\"},\"breadcrumb\":{\"@id\":\"https:\/\/abovethelaw.com\/legal-innovation-center\/2018\/10\/08\/why-blockchain-and-the-gdpr-collide-over-your-personal-data\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/abovethelaw.com\/legal-innovation-center\/2018\/10\/08\/why-blockchain-and-the-gdpr-collide-over-your-personal-data\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/abovethelaw.com\/legal-innovation-center\/2018\/10\/08\/why-blockchain-and-the-gdpr-collide-over-your-personal-data\/#primaryimage\",\"url\":\"\",\"contentUrl\":\"\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/abovethelaw.com\/legal-innovation-center\/2018\/10\/08\/why-blockchain-and-the-gdpr-collide-over-your-personal-data\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/abovethelaw.com\/legal-innovation-center\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Why Blockchain And The GDPR Collide Over Your Personal Data\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/abovethelaw.com\/legal-innovation-center\/#website\",\"url\":\"https:\/\/abovethelaw.com\/legal-innovation-center\/\",\"name\":\"Above The Law's Legal Tech Non-Event\",\"description\":\"A Legal Tech Adoption Guide For Perplexed Lawyers\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/abovethelaw.com\/legal-innovation-center\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/abovethelaw.com\/legal-innovation-center\/#\/schema\/person\/5fe0e6ed2a9f76d7b23328c476efb962\",\"name\":\"Tom Kulik\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/abovethelaw.com\/legal-innovation-center\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/8148f29922fedbd743f5dccbcaabbfdecb3686c9dfe46d5688abc34a8d8ef962?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/8148f29922fedbd743f5dccbcaabbfdecb3686c9dfe46d5688abc34a8d8ef962?s=96&d=mm&r=g\",\"caption\":\"Tom Kulik\"},\"description\":\"Tom Kulik is an Intellectual Property & Information Technology Partner at the Dallas-based law firm of Scheef & Stone, LLP. In private practice for over 20 years, Tom is a sought-after technology lawyer who uses his industry experience as a former computer systems engineer to creatively counsel and help his clients navigate the complexities of law and technology in their business. News outlets reach out to Tom for his insight, and he has been quoted by national media organizations. Get in touch with Tom on Twitter (@LegalIntangibls) or Facebook (www.facebook.com\/technologylawyer), or contact him directly at tom.kulik@solidcounsel.com.\",\"url\":\"https:\/\/abovethelaw.com\/legal-innovation-center\/author\/tomkulik\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Why Blockchain And The GDPR Collide Over Your Personal Data - Above The Law's Legal Tech Non-Event","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/abovethelaw.com\/legal-innovation-center\/2018\/10\/08\/why-blockchain-and-the-gdpr-collide-over-your-personal-data\/","og_locale":"en_US","og_type":"article","og_title":"Why Blockchain And The GDPR Collide Over Your Personal Data - Above The Law's Legal Tech Non-Event","og_description":"When it comes to data privacy law and your personal data, blockchain technology represents the proverbial round peg that does not fit squarely within the four corners of the law.","og_url":"https:\/\/abovethelaw.com\/legal-innovation-center\/2018\/10\/08\/why-blockchain-and-the-gdpr-collide-over-your-personal-data\/","og_site_name":"Above The Law's Legal Tech Non-Event","article_published_time":"2018-10-08T21:03:21+00:00","author":"Tom Kulik","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Tom Kulik","Est. reading time":"5 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/abovethelaw.com\/legal-innovation-center\/2018\/10\/08\/why-blockchain-and-the-gdpr-collide-over-your-personal-data\/","url":"https:\/\/abovethelaw.com\/legal-innovation-center\/2018\/10\/08\/why-blockchain-and-the-gdpr-collide-over-your-personal-data\/","name":"Why Blockchain And The GDPR Collide Over Your Personal Data - Above The Law's Legal Tech Non-Event","isPartOf":{"@id":"https:\/\/abovethelaw.com\/legal-innovation-center\/#website"},"primaryImageOfPage":{"@id":"https:\/\/abovethelaw.com\/legal-innovation-center\/2018\/10\/08\/why-blockchain-and-the-gdpr-collide-over-your-personal-data\/#primaryimage"},"image":{"@id":"https:\/\/abovethelaw.com\/legal-innovation-center\/2018\/10\/08\/why-blockchain-and-the-gdpr-collide-over-your-personal-data\/#primaryimage"},"thumbnailUrl":"","datePublished":"2018-10-08T21:03:21+00:00","dateModified":"2018-10-08T21:03:21+00:00","author":{"@id":"https:\/\/abovethelaw.com\/legal-innovation-center\/#\/schema\/person\/5fe0e6ed2a9f76d7b23328c476efb962"},"breadcrumb":{"@id":"https:\/\/abovethelaw.com\/legal-innovation-center\/2018\/10\/08\/why-blockchain-and-the-gdpr-collide-over-your-personal-data\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/abovethelaw.com\/legal-innovation-center\/2018\/10\/08\/why-blockchain-and-the-gdpr-collide-over-your-personal-data\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/abovethelaw.com\/legal-innovation-center\/2018\/10\/08\/why-blockchain-and-the-gdpr-collide-over-your-personal-data\/#primaryimage","url":"","contentUrl":""},{"@type":"BreadcrumbList","@id":"https:\/\/abovethelaw.com\/legal-innovation-center\/2018\/10\/08\/why-blockchain-and-the-gdpr-collide-over-your-personal-data\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/abovethelaw.com\/legal-innovation-center\/"},{"@type":"ListItem","position":2,"name":"Why Blockchain And The GDPR Collide Over Your Personal Data"}]},{"@type":"WebSite","@id":"https:\/\/abovethelaw.com\/legal-innovation-center\/#website","url":"https:\/\/abovethelaw.com\/legal-innovation-center\/","name":"Above The Law's Legal Tech Non-Event","description":"A Legal Tech Adoption Guide For Perplexed Lawyers","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/abovethelaw.com\/legal-innovation-center\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/abovethelaw.com\/legal-innovation-center\/#\/schema\/person\/5fe0e6ed2a9f76d7b23328c476efb962","name":"Tom Kulik","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/abovethelaw.com\/legal-innovation-center\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/8148f29922fedbd743f5dccbcaabbfdecb3686c9dfe46d5688abc34a8d8ef962?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/8148f29922fedbd743f5dccbcaabbfdecb3686c9dfe46d5688abc34a8d8ef962?s=96&d=mm&r=g","caption":"Tom Kulik"},"description":"Tom Kulik is an Intellectual Property & Information Technology Partner at the Dallas-based law firm of Scheef & Stone, LLP. In private practice for over 20 years, Tom is a sought-after technology lawyer who uses his industry experience as a former computer systems engineer to creatively counsel and help his clients navigate the complexities of law and technology in their business. News outlets reach out to Tom for his insight, and he has been quoted by national media organizations. Get in touch with Tom on Twitter (@LegalIntangibls) or Facebook (www.facebook.com\/technologylawyer), or contact him directly at tom.kulik@solidcounsel.com.","url":"https:\/\/abovethelaw.com\/legal-innovation-center\/author\/tomkulik\/"}]}},"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/abovethelaw.com\/legal-innovation-center\/wp-json\/wp\/v2\/posts\/5324","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/abovethelaw.com\/legal-innovation-center\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/abovethelaw.com\/legal-innovation-center\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/abovethelaw.com\/legal-innovation-center\/wp-json\/wp\/v2\/users\/57534"}],"replies":[{"embeddable":true,"href":"https:\/\/abovethelaw.com\/legal-innovation-center\/wp-json\/wp\/v2\/comments?post=5324"}],"version-history":[{"count":0,"href":"https:\/\/abovethelaw.com\/legal-innovation-center\/wp-json\/wp\/v2\/posts\/5324\/revisions"}],"wp:attachment":[{"href":"https:\/\/abovethelaw.com\/legal-innovation-center\/wp-json\/wp\/v2\/media?parent=5324"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/abovethelaw.com\/legal-innovation-center\/wp-json\/wp\/v2\/categories?post=5324"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/abovethelaw.com\/legal-innovation-center\/wp-json\/wp\/v2\/tags?post=5324"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}