Privacy & Information Security Law Blog

On January 20, 2023, The Centre for Information Policy Leadership (“CIPL”) at Hunton Andrews Kurth published “Digital Assets and Privacy,” a discussion paper compiling insights from workshops with CIPL member companies that explored the intersection of privacy and digital assets, with a particular focus on blockchain technology. The paper includes recommendations for developing coherent, tech-friendly, future-focused, and pragmatic regulations and policies.

As financial services authorities move to regulate digital assets in jurisdictions worldwide, the paper highlights the need to bring privacy regulators into the discussion so that data privacy issues affecting blockchain are addressed in tandem. Given the limited dialogue thus far, there is a pressing need for regulators to understand and navigate the overlapping regulatory realities of digital assets, with the hope of advancing a consistent, comprehensive, and workable regulatory approach.

Key areas of concern identified in the discussion paper include basic privacy principles:

• Applicability of existing laws and definitions. Blockchain technology does not readily align with traditional data protection concepts such as data controller or processor, nor is it confined to a specific jurisdiction, which makes application of existing data protection definitions and regimes challenging.
• Accountability. Blockchain is by design a decentralized system where data is not processed in a centrally controlled manner, thereby making any assessment of who is responsible for determining the means and purpose of the processing rather problematic (or possibly irrelevant).
• Data minimization. Blockchain technology stores data in discrete blocks that are linked together and further appended with additional blocks of data, creating an ever-growing network of data that is hosted perpetually on multiple nodes across different jurisdictions.
• Purpose limitation. Given the nature of blockchain, the further processing of data placed on the chain may not be compatible with the original purpose.
• Data security. Stakeholders have yet to reach a consensus or standardization of encryption techniques to achieve a desired level of data security. Moreover, blockchain’s transparency exposes it to vulnerability by enabling malicious actors to target public keys.
• Confidentiality and government access. Blockchain permits anyone, including governments, to see transactions in a more transparent and unprecedented way.
• Individual rights. Blockchain transactions are recorded forever without possibility of deletion. Moreover, no single authority is equipped to address individual rights requests, including the rights to erasure, rectification, objection, and retention.
• Cross-border data transfers and enforcement. Given the borderless nature of the blockchain, stakeholders need to address the applicability of current cross-border transfer mechanisms and assess options for ongoing and future data flows.

CIPL recommends the following policy considerations for legislative and regulatory proposals:

• Address blockchain’s interplay with data privacy and provide direction to stakeholders through regulations, guidance, memoranda of understanding, and other mechanisms.
• Ensure collaboration and cooperation among regulatory authorities that deal with data, including financial services, competition, and data protection authorities, both within a country and across jurisdictions.
• Implement an innovative approach—ideally one that is technology-neutral, functional, and outcome-driven—that aligns with the characteristics and architecture of blockchain technology.
• Build realistic and achievable goals while engaging with innovators and other stakeholders, taking into account users’ expectations.
• Address how the desired outcomes of privacy rights and principles can be achieved in the blockchain, particularly in public blockchain networks.
• Consider alternative approaches to ensure organizational accountability, especially in public permissionless blockchains.

• Incentivize co-regulatory certifications, industry-recognized standards, PETs (e.g., zero-knowledge proof), and sandboxes to support the application of privacy-enhancing outcomes for blockchain.
• Consider tailoring existing enforcement measures to be both effective and relevant to the blockchain environment.
• Encourage the development of secure infrastructure and processes to ensure the integrity of wallet holders and private keys.

• Educate users about the risks associated with the blockchain ecosystem and the benefits of traditional offline methods.

• Promote transparency regarding government access to blockchain data and ensure that appropriate redress measures are in place.

Ideally, the tensions between privacy and blockchain should be reconciled before regulators promulgate rules that could inhibit innovation. The technology is far from having explored all its potential use cases, and should be allowed to “live” before any new regulations constrain it more than necessary.

For more information about CIPL’s policy recommendations, access the Discussion Paper.