Living in Digital Harmony: Immutable Blockchains and the Right to be Forgotten

Introduction

The Australian Competition and Consumer Commission (ACCC) has recommended reforms to Australia's privacy legislative framework which include the introduction of an erasure right, analogous to the GDPR's 'right to be forgotten'. The ACCC's final report[1] from the Digital Platforms Inquiry includes sweeping recommendations for the regulation of digital content platforms, including search engines and social media networks. The report recommends the introduction of an ‘erasure right’; which would give individuals a right to obtain erasure of personal data upon request.[2]

Blockchain and distributed ledger technologies (DLT), meanwhile, are gaining traction with methods of storing data which are supposedly immutable — where information appended to the ledger cannot be amended or erased.

There is an opportunity for Australia to establish a framework which allows these concepts to coexist, but to do so will require a regulatory approach that is innovative and informed.

So, in a world where consumers must have the ability to obtain changes and erasure of their personal data, is there a place for technologies which prevent those very actions by design?

The right to be forgotten

The Digital Platforms Inquiry examined the effect of digital content aggregation platforms (including search engines and social media networks) on competition in media and advertising markets. The final report includes 23 recommendations covering a number of areas of law, including competition, consumer protection and media regulation. The ACCC made recommendations for broad reform of the Australian privacy law regime and the Privacy Act,[3], which was only recently reformed in 2014.[4] The recommendation of an erasure right follows the introduction of analogous rights in other jurisdictions, most notably Article 17 of the GDPR, which gives data subjects the right to obtain the erasure of personal data in some circumstances.[5] These laws reflect a global trend towards enhanced protection of the rights of the individual with respect to their personal data.

Immutability

Blockchain boasts a number of characteristics not found in a traditional database. Greater transparency, enhanced security and improved traceability are the properties that turn heads in financial services and supply chain management, where complex value chains are riddled by issues of trust, data synchronisation and human error. Underpinning these properties is the claimed immutability of the blockchain.[6] Once a transaction is appended to a public blockchain, it cannot be tampered with or erased. This begs the question, if data being stored on-chain includes personal data, can these systems be compliant with ‘right to be forgotten’ laws such as that proposed by the ACCC?

Solutions in the tech

The first thing to consider is that private, permissioned blockchains do not share the same immutability as public, permissionless networks. If a network is centralised and run by one or a small number of nodes, amending or erasing past data is technically achievable (though whether or not it is operationally viable to be constantly re-writing or modifying past blocks is another story). More interesting are the challenges posed by public, permissionless networks, where in theory no one has the ability to remove or re-write data.

One solution to the potential conflict between ‘the right to be forgotten’ and immutable systems is to encrypt all personal data which is stored on-chain. That way, if a request is made to erase the data, the encryption key can be destroyed, rendering the on-chain data inaccessible. This effectively achieves the same outcome as erasing the data, right? While this solution appears logical, it is not clear whether making data inaccessible complies with the ‘right to be forgotten’ under the GDPR. The GDPR does not expressly contemplate decentralised networks in its drafting, which leaves up to the courts the question of whether data becoming inaccessible is the same as data being erased.

Australia’s opportunity

Herein lies the opportunity for Australian law makers. If the ACCC’s recommendations are to be followed, and we are to introduce rights of erasure, legislators should consider ways to harmonise the apparent conflict between these laws and immutable systems, rather than rendering these innovations non-compliant. One solution could be to include in the reforms, the concept of “effective erasure” which would expressly confirm that methods of rendering immutable data inaccessible (through cryptography or otherwise) are enough to achieve compliance with the erasure right.

The explanatory memorandum to the Privacy Act reforms in 2014 noted that the reforms were intended to be technology neutral, to ensure that the Privacy Act remained flexible and stayed relevant in times of technological change.[7] In this author’s opinion, future reforms should remain principles-based and technology neutral where possible, however they must also be informed by new and developing technologies, and deal with concepts such as immutability and decentralisation directly.

Conclusion

If a new data privacy regime is to be developed, the drafters would do well to take into consideration immutable systems of data storage. It would seem from its text that the GDPR regime was not drafted with decentralised, immutable systems in mind. Australia now has the opportunity to take a more informed approach. As we follow the global trend towards increased individual sovereignty over personal data and enhanced protections of the individual, we would be wise to understand and accommodate emerging technologies so as to avoid squandering the opportunities they present.

[1] Digital Platforms Inquiry - Final Report, June 2019 available at: https://www.accc.gov.au/publications/digital-platforms-inquiry-final-report. [2] Digital Platforms Inquiry - Final Report, June 2019, Chapter 7, Recommendation 16(d). [3] Privacy Act 1988 (Cth). [4] Privacy Amendment (Enhancing Privacy Protection) Bill 2012 (Cth). [5] EU General Data Protection Regulation, Article 17; commonly known as ‘the right to be forgotten’. [6] Blockchains do not achieve true immutability. Rather, once a certain depth of validation is achieved, the economics of the system render tampering a practical impossibility, and practical immutability is achieved. [7] Further Supplementary Explanatory Memorandum, Privacy Amendment (Private Sector) Bill 2000 (Cth), 9.