The transparency challenge of blockchain in organizations

Abstract

This position paper discusses the challenges of blockchain applications in businesses and the public sector related to an excessive degree of transparency. We first point out the types of sensitive data involved in different patterns of blockchain use cases. We then argue that the implications of blockchains’ information exposure caused by replicated transaction storage and execution go well beyond the often-mentioned conflicts with the GDPR’s “right to be forgotten” and may be more problematic than anticipated. In particular, we illustrate the trade-off between protecting sensitive information and increasing process efficiency through smart contracts. We also explore to which extent permissioned blockchains and novel applications of cryptographic technologies such as self-sovereign identities and zero-knowledge proofs can help overcome the transparency challenge and thus act as catalysts for blockchain adoption and diffusion in organizations.

Electronic Markets on platform culture

“…To meet this trade-off, the authors suggest three feasible approaches, which rely on restricting the participation, on exchanging sensitive data off-chain in combination with digital wallets and on-chain workflows, and, finally, on processing data off-chain together with privacy-enhancing technologies, such as SSIs and zero-knowledge proofs. This leads to a key claim of their position paper, which calls for a base layer for the trustworthy and verifiable exchange of data (Sedlmeir et al, 2022).…”

Exploring the use of self-sovereign identity for event ticketing systems

“…In connection with automated and rules-based transaction processing using smart contracts and non-fungible tokens (NFTs), event organizers can transparently record ticket ownership and define rules and price limits for secondary ticket market transactions (Regner et al, 2019 ). Yet this approach is hard to align with data protection regulations, such as the GDPR, particularly regarding the “right to be forgotten.” (Regner et al, 2019 ; Rieger et al, 2021 ; Sedlmeir et al, 2022 ). Also, creating a blockchain account comes with almost no costs, which is why – like the previous centralized systems – blockchain-based ticket systems still require identity-binding and control to prevent scalpers from circumventing the system (Corsi et al, 2019 ; Regner et al, 2019 ).…”

“…Yet this approach is hard to align with data protection regulations, such as the GDPR, particularly regarding the "right to be forgotten." (Regner et al, 2019;Rieger et al, 2021;Sedlmeir et al, 2022). Also, creating a blockchain account comes with almost no costs, which is why -like the previous centralized systems -blockchain-based ticket systems still require identity-binding and control to prevent scalpers from circumventing the system (Corsi et al, 2019;Regner et al, 2019).…”

Enabling end-to-end digital carbon emission tracing with shielded NFTs

“…It also would have significant market power through its control of the platform and access to sensitive personal and business relevant data in terms of energy procurement and emissions labeling (Körner et al 2022). For blockchain-based approaches, the trust issues disappear, but the replicated data storage and processing as well as the impracticality of deleting data from the ledger aggravates issues with sensitive information and conflicts with regulation such as the General Data Protection Regulation (GDPR) (Al Sadawi et al 2021;Zhang et al 2019;Munilla Garrido et al 2021;Sedlmeir et al 2022).…”

“…Another dimension for comparing such proposals is whether the carbon emission tokens are non-distinguishable (fungible) or distinguishable (non-fungible). Most of the related work focuses on non-fungibility since it enables the traceability and verifiability of CO 2 tokens according to their origin, but the uniqueness of the tokens and transactions increases the ability to attribute stakeholders to their pseudonymous wallet addresses on a public blockchain ledger and is, hence, problematic both from the perspective of organizations and individuals (Sedlmeir et al 2022;Biryukov et al 2014;Schellinger et al 2022). On the other hand, privacy-oriented, blockchain-based solutions, such as Sasson et al (2014), or solutions that adapt similar approaches in energyrelated use cases (Baza et al 2021), require that tokens are indistinguishable (fungible) to make transactions unlinkable (Pfitzmann and Hansen 2010), compromising the ability to trace and differentiate different emission sources or to hold stakeholders accountable for malicious behaviour.…”