Blockchain vs GDPR 5 June 2019 Ministry of

Blockchain vs. GDPR 5 June 2019, Ministry of Industry and Trade Hana Gawlasová Partner, Prague T +420 221 662 240 E hana. gawlasova@squirepb. com @hana_gawlas squirepattonboggs. com

Blockchain vs. GDPR „Blockchains are tamper evident and tamper resistant digital ledgers implemented in a distributed fashion (i. e. , without a central repository) and usually without a central authority (i. e. , a bank, company, or government). At their basic level, they enable a community of users to record transactions in a shared ledger within that community, such that under normal operation of the blockchain network no transaction can be changed once published. “ Accuracy Storage limitation Art. 5 (1) (d) GDPR: Personal data shall be accurate and, where necessary, kept up to date; every reasonable step Right to rectification Art. 5 (1) (e) GDPR: Personal shall be kept in aare form must be taken to ensure that data personal data that which permits identification of data subjects no longer inaccurate, having regard to the purposes for which they Right to erasure = right to be forgotten Art. 16 GDPR: The data subject shall have right to is necessary for the for which thethe personal arethan processed, are erased orpurposes rectified without delay; obtain from the […]; controller without undue delay the data are processed Privacy by design & default Art. 17 GDPR: The datapersonal subject shall have the right rectification of inaccurate data concerning him to or obtain her. […]from the controller the erasure of personal data Art. 25 (2) The controller shall and implement concerning him GDPR: or her without undue delay the appropriate technical and organisational measures […] controller shall have the obligation to erase personal data In particular, shall ensure that grounds by default without unduesuch delaymeasures where one of the following personal applies […]; data are not made accessible without the individual's intervention to an indefinite number of natural persons. squirepattonboggs. com 2

Blockchain vs. GDPR: tensions Does GDPR apply to blockchain? § When a blockchain contains personal data, the GDPR is applicable. Main issues concerning GDPR § Personal data, pseudonymous and anonymous data § Data controllers and processors § Lawfulness of data processing § Obligation to inform and rights of the data subjects § DPIA § Security § Privacy by design & by default squirepattonboggs. com 3

Blockchain vs. GDPR: accountability Data controller § A person who makes entries (i. e. make a transaction for which a validation is requested) § A person who decides to submit the data for validation to miners Joint data controllers? Data processor § Smart contract developer § How about miners? squirepattonboggs. com 4

Blockchain vs. GDPR: data subjects‘ rights Right to erasure vs. blockchain principle of irreversibility § Use cryptographic techniques make data quasi-inaccessible (e. g. removal of a private key from a hash) § Do not store data as plaintext Right to rectification vs. blockchain principle of irreversibility § A new block describing the change Automated decision making (incl. profiling) § Provide for the possibility of human intervention squirepattonboggs. com 5

Blockchain vs. GDPR: good friends? GDPR requirements § Data transparency § Data auditability § Access control § Security Blockchain § Decentralized data storage § Blockchain-based identity management squirepattonboggs. com 6

Blockchain: question marks Blockchai n Distribute d ledger Smart contracts Currencie s Jurisdiction Cybersecurity Standardization & interoperability Databases Liability Contractual law E-Privacy Electronic communications Payment services Internet of things AML squirepattonboggs. com 7

People & Technology Hana Gawlasová Jaroslav Tajbr Partner, Prague Of Counsel, Prague T +420 221 662 240 T +420 221 662 241 E hana. gawlasova@squirepb. com E jaroslav. tajbr@squirepb. com Petra Věžníková Jiří Chejn Associate, Prague Junior Associate, Prague T +420 221 662 242 T +420 221 662 150 E petra. veznikova@squirepb. com E jiri. chejn@squirepb. com squirepattonboggs. com 8

Global Coverage Abu Dhabi Atlanta Beijing Berlin Birmingham Böblingen Bratislava Brussels Cincinnati Cleveland Columbus Dallas Darwin Denver Doha Dubai Frankfurt Hong Kong Houston Leeds London Los Angeles Madrid Manchester Miami Moscow Newark New York Northern Virginia Palo Alto Paris Perth Phoenix Prague Riyadh San Francisco squirepattonboggs. com Santo Domingo Seoul Shanghai Singapore Sydney Tampa Tokyo Warsaw Washington DC West Palm Beach Africa Brazil Caribbean/Central America India Israel Italy Mexico Turkey Ukraine Office locations Regional desks and strategic alliances 9