3

The Bitcoin blockchain stores data about bitcoin users. This includes:

  • There bitcoin address, which is linkable to their identity via blockchain analysis
  • Transactions they have made

This would seem to constitute personal data. Would a bitcoin node need consent from any EU citizen who has data on the blockchain? What if an EU citizen made a GDPR request to have their data removed from the blockchain? What about other cryptocurrencies, like Monero, that store transactions but not monero addresses or amounts?

Note that almost any cryptocurrency blockchain can also store arbitrary data (in case the above would not count), although this would be considered a "misuse" of the blockchain in most cases. (There are some blockchains that are designed for arbitrary data storage, however.)

Improve this question
1
  • "bitcoin address, which is linkable to their identity via blockchain analysis" This is false premise. Even if the links between your identity and your bitcoin addresses exist they stay out of bitcoin network.
    – Greendrake
    Feb 7, 2019 at 21:08

1 Answer 1

Reset to default
2

No, consent is not required. There are six lawful bases for processing personal data, see Art. 6. A bitcoin node can base it processing on "performance of a contract" (adding data to the blockchain) or "legitimate interests" (processing existing data).

Bitcoin nodes can be considered joint controllers (Art. 26) because they vote and choose a fork to follow. So the right of erasure (Art. 17) can be exercised against each node. As erasure is not possible in the blockchain, the bitcoin node could have a huge problem. But note that the right of erasure also has conditions, in most cases it is not possible to request erasure.

Of course, the above only applies to the processing of personal data. So it has to be determined first whether personal data is processed. I don't know any details about Monero, so I can't answer that question.

Improve this answer
8
  • 1
    The "performance of a contract" is only contracts the data subject is a part of, and "legitimate interests" usually does not apply to children, as far as I know.
    – PyRulez
    Feb 7, 2019 at 19:50
  • A contract exists after making an offer (broadcasting a transaction to the network) and acceptance of that offer (including the transaction in a block). There are no formalities required to have a contract. Legitimate interests for processing personal data belonging to children have just more safeguards.
    – wimh
    Feb 7, 2019 at 20:26
  • 1
    Ahh yes, sorry.
    – PyRulez
    Feb 7, 2019 at 20:40
  • 1
    A bitcoin transaction cannot be reversed. Also, that is a valid reason to request erasure (Art. 17(1)(d)). So the bitcoin node has two issues to which it basically cannot comply. So it might have to pay damages (Art. 82) but only if the data subject can prove it has damages. So maybe you don't want to be a bitcoin node if you are based in the EU?
    – wimh
    Feb 7, 2019 at 20:58
  • 1
    The EU also has treaties with its allies in which they will enforce the GDPR, I think (but only if the violator is doing business in the EU).
    – PyRulez
    Feb 7, 2019 at 20:59

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .