SWEDEN Law and Practice Contributed by: Niclas Rockborn, Rikard Sundstedt and Robin Entenza, Gernandt & Danielsson
to become a participating node (eg, the most common cryptocurrencies powered by blockchain). The GDPR is based on the assumption that there is a “data subject”, whose personal data is being pro- cessed by a “controller” that determines the purpose and means of the data processing. A typical scenario is of a bank that acts as the “controller” of the per- sonal data that it processes about its customers. The bank may, in its role as a controller, engage service providers as its processors. The GDPR consequently establishes rights for data subjects and corresponding obligations for controllers and processors. In a blockchain context, the allocation of these roles is particularly complex, as there may not be a single controller but rather numerous independent parties uploading, processing and storing data on and out- side the blockchain. It is therefore important to care- fully analyse and define the roles and responsibilities of all parties at an early development stage. The roles set out in the GDPR must therefore be taken into account from the very beginning of the design phase of the blockchain in order to clearly define accountability for fulfilling the obligations that the GDPR imposes on controllers. The architecture of the blockchain must also incor- porate data protection strategies to ensure that data subject rights can be exercised in practice, given that blockchain technology generally only permits data to be added, not removed. A notable example is the right to be forgotten – the right for a data subject to have their personal data erased when there are no longer lawful grounds for processing it – which is inherently difficult to imple- ment on an immutable ledger. The GDPR establishes the concept of “data protection by design and default”, meaning that data protection measures should be implemented as integrated com- ponents of technical systems and services rather than as additional layers. Controllers must also implement appropriate security measures to ensure the ongo- ing confidentiality, integrity, availability and resilience
of processing systems and services and to restore personal data in the event of any unforeseen incident. Where appropriate, security measures should also include measures for the encryption of data, which is particularly interesting in the context of blockchain technology. There is an important distinction between truly anonymised data and data that is only pseu- donymised. Where an anonymisation process results in data that is impossible to link to any individual and where that process is also irreversible, the resulting anonymous data is entirely beyond the scope of the GDPR. Methods for removing identifying characteristics of data that do not meet this standard of true anonymi - sation are instead referred to as “pseudonymisation” and the GDPR remains applicable to pseudonymised personal data. In a blockchain context, data will often qualify as pseudonymised rather than anonymised, because although a public blockchain may not openly contain identifying details, it is typically possible to indirectly link public keys or addresses to individuals through pattern analysis. Blockchain-based services are therefore generally not considered anonymous and remain subject to the GDPR, although each blockchain must be assessed on the basis of its particular characteristics. In April 2025, the European Data Protection Board (EDPB) published draft guidelines on the processing of personal data through blockchain technologies. The guidelines address the intersection of the GDPR and blockchain technology and provide a framework for assessing the implications of blockchain architecture on personal data processing, emphasising the need for careful consideration of roles and responsibilities within the blockchain ecosystem. One of the matters the draft guidelines address is potential ways to satisfy the requirements in the GDPR in blockchain-based data processing where the technical possibilities of deleting or modifying data are typically very limited or non-existent, due to the inherent essential characteristics of blockchain tech- nology. The draft guidelines suggest that technical security measures such as encryption of data, hashing
613 CHAMBERS.COM
Powered by FlippingBook