GDPR - The Most Stringent Data Privacy Regulation in EU

Next week, from 25 May 2018 to be precise, the General Data Protection Regulation (GDPR) will become enforceable in EU region. This is one of the most strict data privacy regulations in the world. Businesses had to invest to the tune of billions of dollars to ensure their compliance with this new data privacy regulation.

In light of this, the words of Steemit CEO, Ned Scott, in the panel discussion held this week at Consensus 2018 event becomes very important. Steem Witness @ura-soul has raised a serious concern upon the onus of legal liability for the content take down issue. Who should be held responsible for that?

Steem Witnesses Should Face All Legal Issues Related to Steem Blockchain?

Ned Scott has clearly stated that the data can be made inaccessible or obscured by the front-end tools like Steemit, Busy and Dtube. So these apps can comply when the issue of content removal arises. But since blockchain technology cannot DELETE any data, Steem network may not remove any content even if it is legally requested to do so.

Steem blockchain is unmutable but this doesn't apply to its front-end apps. This implies that people and organizations that manage and facilitate Steem blockchain i.e. Steem Witnesses are legally liable for their inability to remove any content when legally mandated to do so.

Do Witnesses take this risk into account while opting-in to run a Witness server? Can they actually be held liable for it?

Blockchains Can NOT Comply With GDPR

GDPR regulations are framed to serve the best interest of consumers and are an attempt to give them total control of their own personal data from the clutches of centralized corporations. But paradoxically, it makes the whole public blockchain technology questionable …and may be obsolete by some opinions as blockchains in the current state can’t comply with these regulations.

Public blockchains are permission-less, publicly distributed ledger. Anyone can access that data and run a full node. But GDPR requires the data to be confined in the boundaries of EU only. So no one outside the EU can run a node.

Only Centralized Businesses Were Considered While Framing GDPR

The distinction between data controller, data processer and the data provider also becomes blurred in the case of public blockchains as anyone can download the full ledger in their own computer, run a full node while transacting over the blockchain. So by virtue of this, a consumer herself is the provider, controller and processor of the data. So I wonder who will sue whom?

The regulation also has a provision of a penalty to the extent of up to 4% of the global revenue of the business in question. In the case of Steem, it will be Witnesses. But their earnings are in Steem tokens, the legal validity and value of which is still doubtful. In case if these tokens can’t be liquefied, can a Court enforce an attachment of tokens by freezing them or auctioning them?

The right to be forgotten or the right to erasure is also not very clearly defined in GDPR. So, irreversible encryption of content on the blockchains can also be deemed as erased.

In fact, all data in blockchain is already in hashed and encrypted form. I don’t know much, but what @ned seemed to be conveying is that only front-end apps like Steemit presents the data in readable form. So if all apps (including blockchain explorers) can take down content at their end, will the data be still accessible by general public? I guess, GDPR encourages data anonymization and pseudonimisation as a solution to safeguard consumers’ privacy.

A Precedent In Support of Steem

There was an interesting case where only data processor Google (like Steemit app) was held liable for displaying the information from a newspaper website where as the data controller newspaper (Steem blockchain in this analogy) was not held responsible. I think if this precedent was applied to Steem network, it will spare Steem Blockchain, (the data storehouse) and only held front-end apps like Steemit (data processor) responsible for taking down content. This according to @ned is possible to do. But this case predates GDPR.

I feel there aren’t much option before blockchain-based businesses for GDPR compliance. But in future, the blockchain design can involve features to make them compatible with GDPR kind of restrictions. This will surely come at the cost of wider innovations in this technology, if such a law is adopted across the world.

Can GDPR Really Protect Consumer Privacy?

May be, such a regulation can safeguard consumers’ privacy better. But blockchains are, by nature, transparent, decentralized and trustless DLTs. To protect anything, first we need to isolate and confine it. But if it is confined, it becomes centralized and prone to hackers or attacks. This ultimately put a risk on consumers’ data. I dunno what, but it’s an interesting paradox to me.

So I’m interested to learn what other Witnesses or techies are thinking about this issue and how a public blockchain will survive GDPR post 25th May, 2018.

Any clue?