EDPB Consults on Guidance for Processing Personal Data Through Blockchains

The board defined blockchain technology as a distributed digital ledger system that can confirm transactions and establish the owner of a digital asset such as cryptocurrency at a given time. Blockchains can also support the secure handling and transfer of data, ensuring its integrity and traceability, the board noted.

With blockchain use growing, the EDPB said it's important to help organizations that use the technology to comply with the General Data Protection Regulation. The guidelines explain how the technology works and assess different possible architectures and their implications for personal data processing.

The guidance stresses the importance of employing technical and organizational measures during the earliest phases of designing blockchain processes, the board said. It also clarifies the need to assess the roles and responsibilities of different actors in blockchain-related processing, and encourages companies to perform data protection impact assessments before processing personal data through a blockchain if that could lead to a high risk to people's rights.

The guidelines also give examples of different techniques for data minimization and for handling and storing personal data. The board cautioned that individuals' rights to transparency, data rectification and erasure remain key.

Comments are due June 9.

The EDPB also decided to cooperate closely with the EU AI Office on guidelines on the interplay between the AI Act and EU data protection law.