Right to Be Forgotten and Blockchain: the eternal dichotomy?

Right to Be Forgotten and Blockchain: the eternal dichotomy?

In the digital age, the right to be forgotten stands as a fundamental pillar for protecting individuals’ privacy and reputation, ensuring the possibility of erasing personal information from the internet. However, this need to delete data clashes directly with the intrinsic characteristics of blockchain technology, known for its decentralized structure and data immutability. 

This article examines the relationship between the right to be forgotten and blockchain, with a focus on data permanence, compliance with the General Data Protection Regulation (GDPR), and potential solutions to reconcile this apparent incompatibility.

Data Permanence in Blockchain

Blockchain operates as a decentralized ledger where each block of information is cryptographically linked to the previous one, forming an unalterable chain. One of its primary advantages is immutability: once a piece of data is recorded in the blockchain, it cannot be modified or deleted without compromising the integrity of the entire network. This design ensures trust, security, and transparency across sectors such as finance, logistics, and smart contracts.

However, this very feature poses a challenge to the principles of the right to be forgotten. The inability to alter or delete data can create legal conflicts, particularly when personal information such as names, addresses, or financial details are recorded on a public blockchain. The risk lies in perpetuating sensitive information beyond the individual’s control or consent.

GDPR and Blockchain

The GDPR establishes stringent rules for the processing of personal data, including the right to be forgotten as outlined in Article 17. This right allows individuals to request the deletion of their personal data when it is no longer necessary for the purposes for which it was collected or when its processing violates the regulation.

Furthermore, the GDPR mandates the limitation of data retention, ensuring that personal data is not kept longer than necessary. This creates a fundamental contradiction: while the GDPR requires that personal data be erasable, blockchain’s design makes such erasure challenging or even impossible.

Adding to the complexity, the decentralized nature of blockchain raises questions about the identification of a data controller. In distributed networks without a central authority, who is responsible for ensuring GDPR compliance? This legal ambiguity remains a fertile ground for ongoing debates.

Is Blockchain Incompatible with the Right to Be Forgotten?

While the conflict between blockchain and the right to be forgotten appears insurmountable, emerging approaches aim to bridge the gap between these two realities:

1. Data Minimization and Anonymization

One viable solution is applying the principle of data minimization, as outlined in the GDPR. Instead of storing personal data directly on the blockchain, unique identifiers or cryptographic hashes can be recorded, allowing verification without exposing original data. Additionally, effective anonymization can remove the “personal” nature of data, thus reducing the applicability of the right to be forgotten.

2. Off-Chain Solutions

Another alternative involves off-chain systems, where personal data is stored outside the blockchain on servers controlled by third parties. The blockchain would only contain references to this data, making deletion or modification possible without compromising the network’s integrity.

3. Hybrid Blockchain Models

Hybrid blockchains, which combine features of public and private networks, provide greater control over stored data. In this setup, specific entities can be designated as data controllers, ensuring GDPR compliance and allowing greater flexibility to implement the right to be forgotten.

4. Smart Contracts with Expiration Clauses

Another potential innovation is the development of smart contracts with expiration clauses. These contracts can be programmed to delete or deactivate access to specific data after a set period, aligning with data retention limitations.

Conclusion

The right to be forgotten and blockchain technology exemplify the tension between privacy and technological innovation. While the immutable and decentralized nature of blockchain appears incompatible with the need to erase personal data, emerging solutions such as anonymization, off-chain systems, and hybrid models offer hope for reconciling these seemingly opposing values.

The future of this relationship will depend heavily on collaboration among lawmakers, technologists, and businesses. Striking a balance that respects individuals’ fundamental rights without stifling the transformative potential of blockchain is imperative. The key lies in responsible innovation, leveraging the benefits of blockchain while upholding data protection principles.

At Letslaw we are specialists in data protection and technology law, so we can help you develop your projects with the appropriate guarantees.