Enabling GDPR Compliant Trading of Personal Data on the Blockchain

The General Data Protection Regulation (GDPR) aims primarily to give control back to consumers regarding their personal data and to simplify the regulatory environment for international business. This is mandatory for any company that stores or processes personal data about EU citizens, regardless whether they own a business in the EU. This suggests that almost every company worldwide would have to comply with this regulation. A PwC report shows that more than 90% of all companies in the US consider GDPR a top data protection priority!

The following list provides an overview of the types of data that are protected by GDPR:
• Basic identity information such as name, address and ID numbers
• Web data such as location, IP address, cookie data and RFID tags
• Health and genetic data
• Biometric data
• Racial or ethnic data
• Political opinions
• Sexual orientation

PDATA’s primary strategy is to be decentralised, meaning the platform is not designed to hold data as an intermediary between the consumers providing data and the companies that request data, but just to mediate transactions between the two parties.

PDATA achieves this concept by storing cleartext information and uses this solely to prove the existence of that data, as well as some information regarding the data. This enables the companies to filter for consumer profiles and datasets which are of interest to them.

Where is the data stored? The original unencrypted data never leaves the storage of its owner; this is usually on the device where the data was derived (e.g. the user´s smartphone). The data becomes encrypted once it leaves the device.

Encryption is based on asymmetric cryptography; this involves the use of a public and private key. For each dataset present in the system, the owner generates a unique public/private key pair and encrypts the data with the public key, while not giving away the corresponding private key. Data encrypted this way is stored on a P2P network of servers for easy accessibility. The reason as to why the data must be readily accessible is so that this data can be retrieved even if the device of the consumer is offline and to ensure that the storage used for personal data on consumer devices is kept at a minimum level. The critical fact here is that this data is entirely useless for anyone not holding the private key, so effectively the data is completely protected, and only its owner can use it, even though it resides on a server/network of servers.

Figure 1 visualises the process of trading personal data on the PDATA platform. Consumers continuously submit their encrypted data to the platform where it is stored, as mentioned above.

The data is then sent through the Opiria app or by connecting different services to the platform (like wearables, smart home devices and browser plugins).

Let us use an example and put Figure 1 into perspective. When a need for specific data from consumers is needed, a company will send a data request on the PDATA platform (Step 1) for a specific consumer profile (like requesting data XYZ and offering N PDATA tokens in return as compensation). The platform will then match this request with the consumers who can provide this specific data (Step 2). An offer will then be sent to the target consumers (Step 3). This is how the proposal is made: Company A would like to access data XYZ from you and in turn, offers N PDATA tokens for it. Do you want to accept this offer?In case the consumer accepts (Step 4), the PDATA platform informs the smart contract in the blockchain of a pending transaction and prepares for the exchange of the specified data from the consumer to the company for the defined amount of PDATA tokens (Step 5).

Next, the smart contract executes the transaction (Step 6). This means that the smart contract takes the PDATA tokens which the consumer will receive (6.1) into escrow. The consumer’s private dataset key is sent through the blockchain from the consumer (6.2) to the company (6.3). The private dataset key is encrypted with the company’s public key so that only the company has access to it. The PDATA tokens are then transferred to the consumer’s account (6.4), and the company receives the still encrypted dataset it has bought (6.4). Finally (Step 7) the company has both the dataset and the private dataset key which allows for the data to be decrypted and used.

The following will describe how the PDATA platform fulfils the GDPR requirements regarding privacy and protection of personal data.

1. Consent as lawful basis for processing Requirement: according to art. 6, personal data can only be processed on a legitimate basis, based on the consumer’s consent.By entering the PDATA platform, consumers give their consent for storing their personal data in an encrypted format. The platform informs the consumers with regards to each request made by companies concerning their personal data. The consumers then have the choice of either giving their consent allowing the company to access their data or not. In the case of giving consent, the smart contract mediates the transaction in a secure and decentralised way.

The given consent can be demonstrated through the PDATA smart contract -which codifies every action of its users into a transaction – and is fully traceable through the blockchain. Cases in which consumers withdraw their consent or decide to erase their data is managed by the smart contract, which would terminate access to the specific data.
2. Security of processing and pseudonymisation Processing of personal data must ensure a high level of security (art. 32) including pseudonymisation, encryption, confidentiality, integrity, availability and resilience of processing systems and services.

The GDPR refers to pseudonymization as a process that transforms personal data in a way that resulting data cannot be attributed to a specific subject without the use of additional information. An example of pseudony
misation is encryption, this renders the original data unintelligible, and the process cannot be reversed without access to the correct decryption key. The GDPR requires that the decryption key is kept separately from the pseudonymised data.

This is fulfilled par excellence by the PDATA architecture and the smart contract. Personal data is being stored, encrypted, and only the consumer who is the owner of the data has the key for its decryption. The data and the key are stored in different places; the data on the PDATA platform and the key on the device of the data subject where the data was produced. When it comes to an exchange, the smart contract securely mediates the transaction, ensuring that only the company to which the consumer gave consent can decrypt the data.

Personal data will never leave its source (the consumer) in a non-encrypted format. Hence, it cannot be used by any third party, except with the consent of the user and it also must be governed by the PDATA smart contract.
Overall, the integrity, availability and resilience of the system are ensured by encrypted storage on a network of distributed servers based on peer-to-peer technology, blockchain based transactions, as well as the architecture of the PDATA platform.

3. Right of access, transparency and processing purpose The right of access (art. 15) gives consumers the right to gain access to their personal data. Additionally, they have the right to know how, and by whom their personal data is being processed (art. 13, 14).

Consumers can access their data at any time. The PDATA platform offers an interface where consumers can check and update their personal data.

The PDATA platform requests two things from companies that want to buy data. Firstly, the purpose for which the data will be used and secondly, the envisaged period of usage. The PDATA platform informs the consumers regarding these two points when sending them offers. Further on, consumers will know exactly what data they share (because they must give consent to each data category) and with whom they share it. The smart contract ensures that only the data to which consumers gave consent to will be made available to the companies.

4. Right to rectification, to erasure and data portability The right to rectification (art. 16) gives consumers the possibility to update and complete their personal data. The right to be forgotten (art. 17) means that the consumers have the right to request their personal data to be deleted.

The PDATA platform supports the right to rectification by allowing the consumer to view, change and update their personal data at any time.

The consumer can erase his personal data by simply deleting it under his account on the PDATA platform. His private data keys will be destroyed. This implies a complete loss of all corresponding data. Additionally, the encrypted data will be deleted from the platform.

Consumer’s right to portability (art. 20), meaning the right to receive the consumer’s data in a structured, commonly used format. This is fulfilled by the PDATA platform’s possibility to locally show the consumer all his personal data that is stored on the platform.

5. Records of processing activities The guideline requests in art. 30 that all transactions on personal data shall be documented, including the purposes of the processing and the processed categories of personal data. This is provided by the blockchain, in which the PDATA smart contract creates a record of all transactions including the requested information. Additionally, the code of the PDATA smart contract is open, and all data processing steps on the platform are well documented.

6. Data protection by design and by default The principles stated in art. 25 request that data protection is “designed” into the development of business processes for products and services.

It also requires that privacy settings must be set at a high level by “default”.
PDATA’s trading of personal data is based on the blockchain. Blockchains were built to function in a “trust-less” environment in which people can transact directly with one another without needing to trust any middleman in the ecosystem.

Based on this fundamental principle the PDATA platform´s architecture ensures the following:
• The consumer owns the personal data and has full control over it.
• Personal data never leaves the consumer in an unencrypted format, and only the consumer holds the key to decrypt it.
• Personal data can only be transferred to a company with the consumer´s consent. In addition to that, the consumer knows precisely who is receiving the data and for what purpose.
• The trading of personal data is fully transparent and traceable on the blockchain whereby the anonymity of the trading parties is ultimately protected.

As described in this article, the PDATA platform is the enabler for a secure, lawfulness, fair and transparent trading of personal data; based on the blockchain which is fully compliant to the principles of the GDPR.

  • facebook
  • googleplus
  • twitter
  • linkedin
  • linkedin

ICO Crowd is the world’s first and foremost publication on Initial Coin Offerings (ICO).