“The margin between the edge of the world and infinite possibility”

Abstract

Purpose This paper aims to explore a paradoxical situation, asking whether it is possible to reconcile the immutable ledger known as blockchain with the requirements of the General Data Protection Regulations (GDPR), and more broadly privacy and data protection. Design/methodology/approach This paper combines doctrinal legal research examining the GDPR’s application and scope with case studies examining blockchain solutions from an archival theoretic perspective to answer several questions, including: What risks are blockchain solutions said to impose (or mitigate) for organizations dealing with data that is subject to the GDPR? What are the relationships between the GDPR principles and the principles of archival theory? How can these two sets of principles be aligned within a particular blockchain solution? How can archival principles be applied to blockchain solutions so that they support GDPR compliance? Findings This work will offer an initial exploration of the strengths and weaknesses of blockchain solutions for GDPR compliant information governance. It will present the disjunctures between GDPR requirements and some current blockchain solution designs and implementations, as well as discussing how solutions may be designed and implemented to support compliance. Immutability of information recorded on a blockchain is a differentiating positive feature of blockchain technology from the perspective of trusted exchanges of value (e.g. cryptocurrencies) but potentially places organizations at risk of non-compliance with GDPR if personally identifiable information cannot be removed. This work will aid understanding of how blockchain solutions should be designed to ensure compliance with GDPR, which could have significant practical implications for organizations looking to leverage the strengths of blockchain technology to meet their needs and strategic goals. Research limitations/implications Some aspects of the social layer of blockchain solutions, such as law and business procedures, are also well understood. Much less well understood is the data layer, and how it serves as an interface between the social and the technical in a sociotechnical system like blockchain. In addition to a need for more research about the data/records layer of blockchains and compliance, there is a need for more information governance professionals who can provide input on this layer, both to their organizations and other stakeholders. Practical implications Managing personal data will continue to be one of the most challenging, fraught issues for information governance moving forward; given the fairly broad scope of the GDPR, many organizations, including those outside of the EU, will have to manage personal data in compliance with the GDPR. Blockchain technology could play an important role in ensuring organizations have easily auditable, tamper-resistant, tamper-evident records to meet broader organizational needs and to comply with the GDPR. Social implications Because the GDPR professes to be technology-neutral, understanding its application to novel technologies such as blockchain provides an important window into the broader context of compliance in evolving information governance spaces. Originality/value The specific question of how GDPR will apply to blockchain information governance solutions is almost entirely novel. It has significance to the design and implementation of blockchain solutions for recordkeeping. It also provides insight into how well “technology-neutral” laws and regulations actually work when confronted with novel technologies and applications. This research will build upon significant bodies of work in both law and archival science to further understand information governance and compliance as we are shifting into the new GDPR world.

Trustworthy artificial intelligence

“…A central facet of establishing AI accountability concerns our ability to independently audit AI (i.e., AI's auditability), especially in terms of data provenance (i.e., addressing the malicious training data tension) and the degree of uncertainty with which AI models make their predictions (i.e., addressing the model uncertainty tension). Owing to DLTs characteristics (e.g., decentralization, high tamper resistance), research has recently begun exploring the application of DLT for auditing purposes in organizational contexts (Hofman et al 2019), while first research results also indicate the feasibility of DLT for the auditing of AI (Dillenberger et al 2019). However, the development and deployment of AI are highly dynamic, with training data and algorithms (and thus model uncertainty) rapidly changing and constantly evolving.…”

GDPR Compliant Blockchains–A Systematic Literature Review

“…Blockchain has a specific problem with identifying these roles since there is no centralized authority to control all the nodes [30], [31], [41]. Several approaches have been proposed in prior literature, such as defining the participating nodes as controllers [42], [43], data providers as controllers and miners as processors [44], actors who are able to execute a transaction and add a block as the controllers, joint controllers for federated blockchain [45], and developers as processors for smart contracts [46], [47], [48], [49].…”

“…Information Governance Information Governance [48,45]  Discussed Roles and applicability of blockchain in Information Governance [48,45]…”

“… Compliance design with Article 17 (off chain, pruning, smart contract, chameleon hash) [45].  Network administrator as controller and miners as processor for permissioned blockchain [48,45]…”

“…Smart contract developers as controller and contract itself as processor [48,45].  Zero knowledge proof makes data anonymous [45].…”