Endnotes
1 "European Commission launches the EU Blockchain
Observatory and Forum" European Commission
press release (1 February 2018), available at: http://
europa.eu/rapid/press-release_IP-18-521_en.htm.
2 "EU Blockchain Roundtable paves the way for Europe to
lead in blockchain technologies" (20 November 2018),
available at: https://ec.europa.eu/digital-single-market/en/
news/eu-blockchain-roundtable-paves-way-europe-leadblockchain-technologies
3 French National Commission on Informatics and
Liberty (CNIL), "Blockchain and the GDPR: responsible
solutions regarding the presence of personal data", 24
September 2018, available at: https://www.cnil.fr/en/
node/24807.German Blockchain Federation (Blockchain
Bundesverband), "Blockchain, data protection and
the GDPR", 25 May 2018, available at: https://www.
bundesblock.de/wp-content/uploads/2018/05/GDPR_
Position_Paper_v1.0.pdf. EU Blockchain Observatory and
Forum, "Blockchain and the GDPR", 16 October 2018,
available at: https://www.eublockchainforum.eu/reports.
4 Gabrielle Orum Hernández, Why Blockchain Poses an
Unusual Challenge for GDPR Compliance, LAW.COM, 25
May 2018, available at: https://www.law.com/2018/05/25/
why-blockchain-poses-an-unusual-challenge-for-gdpr-co
mpliance/?slreturn=20181103145145; Tom Cox and
Andrew Solomon, Block chain: Is the GDPR out of date
already?, Lexology, 30 August 2017, available at: https://
www.lexology.com/library/detail.aspx?g=d4c0481a-c678-
4748-80cb-4ab917e66207.
5 EU Blockchain Roundtable paves the way for Europe to
lead in blockchain technologies" (20 November 2018),
available at: https://ec.europa.eu/digital-single-market/en/
news/eu-blockchain-roundtable-paves-way-europe-leadblockchain-technologies
6 EU Blockchain Observatory and Forum, "Blockchain and
the GDPR", 16 October 2018, available at: https://www.
eublockchainforum.eu/reports.
7 Article 9 of the GDPR lists the following special categories
of personal data: "data revealing racial or ethnic origin,
political opinions, religious or philosophical beliefs,
or trade union membership, and the processing of
genetic data, biometric data for the purpose of uniquely
identifying a natural person, data concerning health
or data concerning a natural person's sex life or sexual
orientation".
8 GDPR Article 25.
9 GDPR Article 17(3)(b).
10 GDPR Article 17(3)(e).
11 The European Commission has to-date issued a finding
of adequacy in respect of: Andorra, Argentina, Canada
(partial), Faroe Islands, Guernsey, Isle of Man, Israel, Japan,
Jersey, New Zealand, Switzerland and Uruguay. Adequacy
talks are ongoing with South Korea.
12 The Article 29 Data Protection Working Party was
established under Article 29 of the Data Protection
Directive (Directive 95/46/EC), but has since been
replaced by the European Data Protection Board under
Article 68 of the GDPR.
13 Article 29 Data Protection Working Party, opinion
05/2014 on Anonymisation Techniques (adopted on 10
April 2014), available at: https://www.pdpjournals.com/
docs/88197.pdf.
14 Endorsement 1/2018 of the European Data Protection
Board dated 25 May 2018, available at: https://edpb.
europa.eu/news/news/2018/endorsement-gdpr-wp29-
guidelines-edpb_en.
15 German Blockchain Federation (Blockchain
Bundesverband), "Blockchain, data protection and
the GDPR", 25 May 2018, available at: https://www.
bundesblock.de/wp-content/uploads/2018/05/GDPR_
Position_Paper_v1.0.pdf.
16 UK Anonymisation Network, The Anonymisation
Decision-Making Framework, 2016, available at:
http://ukanon.net/wp-content/uploads/2015/05/theanonymisation-decision-making-framework.pdf.
17 EU Blockchain Observatory and Forum, "Blockchain and
the GDPR", 16 October 2018, available at: https://www.
eublockchainforum.eu/reports.
18 Id. This argument appears to be supported by the
European Parliament's Committee on Civil Liberties,
Justice and Home Affairs, which distinguishes between
data controllers and data processors in a blockchain
setting on the basis of whether a network member
uploads data onto the network. European Parliament
Committee on Civil Liberties, Justice and Home Affairs,
opinion 2018/2085(INI) on Blockchain: A ForwardLooking
Trade Policy (adopted on 15 November 2018),
available at: http://www.europarl.europa.eu/sides/getdoc.
do?type=REPORT&reference=A8-2018-0407&format=XML
&language=EN#title3.
19 EU Blockchain Observatory and Forum, "Blockchain and
the GDPR", 16 October 2018, available at: https://www.
eublockchainforum.eu/reports.
20 CNIL, Blockchain and the GDPR: Solutions for a
responsible use of the blockchain in the context of
personal data, 6 November 2018, available at: https://
www.cnil.fr/en/blockchain-and-gdpr-solutions-responsibleuse-blockchain-context-personal-data.
EU Blockchain Observatory and Forum, "Blockchain and
the GDPR", 16 October 2018, available at: https://www.
eublockchainforum.eu/reports..
21 GDPR Article 28.
22 GDPR Article 26.
23 Id.
24 Article 29 Data Protection Working Party, 14 June
2017 Letter to ESMA, available at: http://ec.europa.eu/
newsroom/document.cfm?doc_id=45447.
25 GDPR Articles 13 and 14.
26 Id.
27 Id.
28 Article 29 Data Protection Working Party, opinion
05/2014 on Anonymisation Techniques (adopted on 10
April 2014), available at: https://www.pdpjournals.com/
docs/88197.pdf.
29 Id.
30 Id.
31 Article 29 Data Protection Working Party, opinion
05/2014 on Anonymisation Techniques (adopted on 10
April 2014), available at: https://www.pdpjournals.com/
docs/88197.pdf.
This view is not shared by the UK Anonymisation
Network, which has adopted a relative view of
anonymization-i.e., data can simultaneously be
anonymous data to one data controller and personal data
to another data controller depending on the individual
data controller's ability to identify the data. Regardless
of whether characterization as anonymous data is a
relative or absolute determination, the only way to ensure
personal data becomes anonymous data for all members
of a blockchain network under the deletion by encryption
technique is to obligate all members to delete their
keys. UK Anonymisation Network, The Anonymisation
Decision-Making Framework, 2016, available at:
http://ukanon.net/wp-content/uploads/2015/05/theanonymisation-decision-making-framework.pdf.
32 U.S. Patent No. 9,959,065 (filed Oct. 5, 2017). For more
discussion on the patent and editable blockchains,
please see: Accenture, Editing the Uneditable
Blockchain, available at: https://www.accenture.com/
t20160927T033514Z__w__/us-en/_acnmedia/PDF-33/
Accenture-Editing-Uneditable-Blockchain.pdf#zoom=50.
33 Id.
34 European Data Protection Supervisor Newsletter No.66,
January 2019, available at: https://edps.europa.eu/presspublications/publications/newsletters/newsletter-66_en.
35 Steve Saxox & Matt Stone, Container Shipping: The Next
50 Years, McKinsey & Company (October 2017). Available
at: https://www.mckinsey.com/~/media/mckinsey/
industries/travel%20transport%20and%20logistics/
our%20insights/how%20container%20shipping%20
could%20reinvent%20itself%20for%20the%20digital%20
age/container-shipping-the-next-50-years-103017.ashx.
36 Michael White, Digitizing Global Trade with Maersk and
IBM, IBM (16 January 2018). Available at: https://www.
ibm.com/blogs/blockchain/2018/01/digitizing-global-trademaersk-ibm/.
37 Steve Saxox & Matt Stone, Container Shipping: The Next
50 Years, McKinsey & Company (October 2017). Available
at: https://www.mckinsey.com/~/media/mckinsey/
industries/travel%20transport%20and%20logistics/
our%20insights/how%20container%20shipping%20
could%20reinvent%20itself%20for%20the%20digital%20
age/container-shipping-the-next-50-years-103017.ashx.
38 Id.
39 Michael White, Digitizing Global Trade with Maersk and
IBM, IBM (16 January 2018). Available at: https://www.
ibm.com/blogs/blockchain/2018/01/digitizing-global-trademaersk-ibm/.
40 Id.
41 Reuters, European Regulators: We're Not Ready for
New Privacy Law (8 May 2018), available at: https://
www.reuters.com/article/us-europe-privacy-analysis/
european-regulators-were-not-ready-for-new-privacy-lawidUSKBN1I915X.
42 European Parliament Committee on Civil Liberties,
Justice and Home Affairs, opinion 2018/2085(INI) on
Blockchain: A Forward-Looking Trade Policy (adopted on
15 November 2018), available at: http://www.europarl.
europa.eu/sides/getDoc.do?type=REPORT&reference=A8-
2018-0407&format=XML&language=EN#title3.
GDPR and the Blockchain I 47