AUSTRIA Law and Practice Contributed by: Oliver Völkel, Jara Erhard and Bryan Hollmann, CERHA HEMPEL
experts. This council assesses the economic interest, market readiness and testing feasibility of the busi- ness model. Based on the council’s assessment, the FMA makes its final decision on whether to admit the applicant to the sandbox. 1.1.3 Regulation of Blockchain Technology Regulatory Stance Towards Blockchain Industries Austria’s stance towards blockchain-based business is generally innovation-friendly, while still placing sig- nificant emphasis on investor protection and market integrity. The FMA actively promotes fintech develop- ments, as stated at 1.1.2 Regulatory Sandbox . Over the past years, Austria has emerged as a key EU location for CASPs, and the FMA is regarded as an opinion leader at the EU level due to its deep under- standing of DLT and blockchain business models. Notably, the FMA has confirmed that truly decentral- ised DeFi protocols operate without regulatory super- vision, reflecting a pragmatic, substance-over-form approach. No particular use cases are expressly pro- hibited. However, the FMA regularly issues consumer warnings on the risks of unregulated crypto activities and rigorously enforces MiCA and other applicable rules, including through substantial fines, thereby set- ting a level playing field for compliant market partici- pants (see also 2.2 Crypto-Asset Regulatory Frame- works ). Regulation of Blockchain as an Underlying Technology Austria has no blockchain‑specific legislation; regu- lators use a substance‑over‑form approach, so the applicable rules depend on the activity, not the tech- nology. When blockchain technology is used outside the crypto-asset context – for example, when regu- lated financial institutions outsource to, or deploy, blockchain‑enabled solutions – it is simply caught by the existing general regulatory framework. In prac- tice, a regulated financial institution using a block- chain‑based service must comply with the usual outsourcing standards, including MiFID II and the relevant ESMA outsourcing guidelines, just as for any other third‑party provider. Since January 2025, these arrangements must also meet the requirements of the Digital Operational Resilience Act (DORA), which adds
strict obligations on IT risk management, incident reporting and oversight of third‑party ICT providers. Data Privacy and “Right to be Forgotten” in Blockchain Use Blockchain-based products and services are subject to the EU General Data Protection Regulation (GDPR). To ensure that the processing of personal data through blockchain technologies complies with the GDPR, the European Data Protection Board (EDPB) has adopted guidelines. The underlying challenge regarding data privacy is that modifying or deleting data stored on the blockchain is often practically impossible. The storage of personal data can therefore result in a conflict with data pro- tection principles. In general, it is not advised to store personal data in a directly identifying form. Instead, the EDPB proposes to encrypt data before storing it on a blockchain, to store only a salted or keyed hash of the personal data or storing a cryptographic commitment on the blockchain. These solutions need to be accompanied by adequate organisational and technical measures to mitigate data protection risks. The guidelines introduce a (sometimes mandatory) Data Protection Impact Assessment (DPIA) prior to implementing blockchain-based processing. In practice, the Regulation plays a role only when it comes to centralised market participants such as CASPs, token issuers or when a smart contract is used to provide services to others. In the case of fully decentralised systems (see 6.2.1 Fiat Currency and Algorithmic Stablecoins ), speaking from a practical perspective, the GDPR becomes a non-issue. The so- called right to be forgotten can be maintained by stor- ing personal data on the blockchain only in encrypted form and storing a separate decryption key for every data entry stored on the blockchain. If someone exer- cises their right to be forgotten, this request can be complied with by simply deleting the decryption key associated with the data entry to be deleted. 1.1.4 Smart Contracts Enforceability It is widely accepted in Austrian legal literature that smart contracts can be used to make contractual offers, to receive such offers, and also to form con-
39 CHAMBERS.COM
Powered by FlippingBook