2

The Bitcoin blockchain stores data about bitcoin users. This includes:

  • There bitcoin address, which is linkable to their identity via blockchain analysis
  • Transactions they have made

This would seem to constitute personal data. Would a bitcoin node need consent from any EU citizen who has data on the blockchain? What if an EU citizen made a GDPR request to have their data removed from the blockchain? What about other cryptocurrencies, like Monero, that store transactions but not monero addresses or amounts?

Note that almost any cryptocurrency blockchain can also store arbitrary data (in case the above would not count), although this would be considered a "misuse" of the blockchain in most cases. (There are some blockchains that are designed for arbitrary data storage, however.)

  • "bitcoin address, which is linkable to their identity via blockchain analysis" This is false premise. Even if the links between your identity and your bitcoin addresses exist they stay out of bitcoin network. – Greendrake Feb 7 at 21:08
2

No, consent is not required. There are six lawful bases for processing personal data, see Art. 6. A bitcoin node can base it processing on "performance of a contract" (adding data to the blockchain) or "legitimate interests" (processing existing data).

Bitcoin nodes can be considered joint controllers (Art. 26) because they vote and choose a fork to follow. So the right of erasure (Art. 17) can be exercised against each node. As erasure is not possible in the blockchain, the bitcoin node could have a huge problem. But note that the right of erasure also has conditions, in most cases it is not possible to request erasure.

Of course, the above only applies to the processing of personal data. So it has to be determined first whether personal data is processed. I don't know any details about Monero, so I can't answer that question.

  • The "performance of a contract" is only contracts the data subject is a part of, and "legitimate interests" usually does not apply to children, as far as I know. – PyRulez Feb 7 at 19:50
  • A contract exists after making an offer (broadcasting a transaction to the network) and acceptance of that offer (including the transaction in a block). There are no formalities required to have a contract. Legitimate interests for processing personal data belonging to children have just more safeguards. – wimh Feb 7 at 20:26
  • 1
    Ahh yes, sorry. – PyRulez Feb 7 at 20:40
  • 1
    A bitcoin transaction cannot be reversed. Also, that is a valid reason to request erasure (Art. 17(1)(d)). So the bitcoin node has two issues to which it basically cannot comply. So it might have to pay damages (Art. 82) but only if the data subject can prove it has damages. So maybe you don't want to be a bitcoin node if you are based in the EU? – wimh Feb 7 at 20:58
  • 1
    The EU also has treaties with its allies in which they will enforce the GDPR, I think (but only if the violator is doing business in the EU). – PyRulez Feb 7 at 20:59

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.