The European Data Protection Board (EDPB) has adopted new guidelines for the use of blockchain technology. The guidelines allow organizations to see how to properly protect personal data if they want to use blockchains.
The various privacy regulators in Europe, working together in the EDPB, explain in the guidelines how blockchains work, an opinion on the different ways to design a blockchain and information on the consequences of using personal data in a blockchain.
The EDPB makes several points in the guidelines, including:
Privacy by design is very important: right from the design of the technology, the creator must consider careful handling of personal data.
Organizations must conduct a data protection impact assessment (DPIA) before processing personal data through blockchain technologies when the processing is likely to result in a high risk to people's rights and freedoms.
Organizations must apply the principle of data minimization when they want to process personal data in a blockchain.
It should be possible to exercise your privacy rights if your personal data is in the blockchain. Such as the right to inspect and the right to rectify (change) your personal data. If that is not technically feasible for organizations, such as with the right to delete data, the EDPB recommends looking at other ways to protect data before processing, such as anonymizing data or by using another tool instead of blockchain.
These guidelines are not yet final. Anyone who wishes to do so may comment on the guidelines through June 9, 2025 via the website of the EDPB. After this consultation, the EDPB will adopt the final guidelines.
The Personal Data Authority (AP) is one of the privacy regulators in the EDPB.
