2 - Potential solution: Avoiding the use of persistent
identifiers for individuals
If a blockchain solution is being deployed in a business
context, one way to avoid addresses being treated
as personal data is to ensure that (if practicable) all
participants on the network are bodies corporate rather
than individuals.
Another possibility is to employ a blockchain technology
that avoids using persistent public addresses for
participants. Some blockchain technologies use
cryptography to generate a different address to refer to a
participant for each transaction. This helps to obfuscate
the identity of participants, making it much more difficult
to piece together different transactions undertaken by
those participants which, when combined with other
information, could uncover the identity of the individual.
B
The problem of inadvertent addition
of personal data
1 - The challenge
In addition to addresses on the network, another way
personal data can land on the blockchain ledger is where
substantive data uploaded to the blockchain as part of a
transaction on the network (the transaction payload data)
contains personal data. A transaction payload containing
an individual's name, address, phone number, email
address, or other contact or identifying details will result in
that personal data being added to the blockchain. Even if
the network is operating purely in a business context,
this can occur incidentally, for example, if the ledger is
used to record:
• an email address for invoicing, and that email
address includes a person's name;
• a copy of a receipt for a commercial
transaction identifying the individual who
completed that transaction;
• a photograph where the image happens to also
include an identifiable living person; or
• a copy of a contract that includes the name of an
individual signing the contract on behalf of
one of the parties.
So while a blockchain solution may be designed to avoid
storing personal data, there are numerous instances where
personal data may nevertheless be added to the ledger.
22 I GDPR and the Blockchain