Data Protection Issues for Smart Contracts

Abstract

Smart contracts offer promise for facilitating and streamlining transactions in many areas of business and government. However, they also may be subject to the provisions of relevant data protection laws, if personal data is processed. This Chapter focuses on the European Union’s General Data Protection Regulation (GDPR), as the most significant and influential data protection legislation at this time, given in part to its omnibus nature and extraterritorial scope. By their very nature, smart contracts raise difficulties for the classification of the various actors involved, which will have an impact on their responsibilities under the law and their potential liability for violations. Our analysis focuses primarily on the role of data controller in the context of blockchain technology, used in smart contracts. In doing so, the signification of the classification is highlighted in the context of the GDPR. Furthermore, certain rights granted to data subjects under the GDPR may be difficult to provide in the context of smart contracts, such as the right to rectification and the right to erasure (‘right to be forgotten’). This Chapter addresses such issues, together with relevant advisory guidance and recommendations, such as the use of encryption in order to make data nearly inaccessible in order to approach as nearly as possible the same result as erasure, and the storage of certain data off-chain. On the way, the important distinction between anonymised data and personal data is explained, together with its practical implications. Finally, the GDPR requirements of data minimisation, of data security (‘integrity and confidentiality’), and of privacy by design and by default must be respected, if that legislation applies. This means that data protection and privacy must be considered when smart contracts are designed.