Report on Data Privacy Regulations Applicable to Blockchain Technology in Various Jurisdictions Worldwide
Total Page:16
File Type:pdf, Size:1020Kb
Report on Data Privacy Regulations Applicable to Blockchain Technology in Various Jurisdictions Worldwide By the Privacy Working Group of INATBA DECEMBER 2020 Report on Data Privacy Regulations Applicable to Blockchain Technology in Various Jurisdictions Worldwide December 2020 Contents 1. Executive Summary .......................................................2 2. Introduction ..............................................................3 3. Cross-country comparison .................................................5 4. Contributors ..............................................................7 5. EU General Data Protection Regulation .............................. 8 6. Country specific chapters ................................................15 Brazil .............................................................15 Canada .......................................................... 20 China ............................................................ 27 Hong Kong .......................................................41 India ............................................................46 Japan ........................................................... 57 Russia ........................................................... 62 Singapore ....................................................... 70 South Korea ..................................................... 75 Switzerland ......................................................80 Ukraine ..........................................................84 United Kingdom .................................................90 United States .................................................... 96 1 Report on Data Privacy Regulations Applicable to Blockchain Technology in Various Jurisdictions Worldwide December 2020 1. Executive Summary Around the globe, different privacy-related regulations apply, but how do these various regulations impact blockchain technology? Which jurisdictions are the most favoura- ble for technology applications and which are the most limiting? Through the involve- ment of leading international privacy experts, the INATBA Privacy Working Group has sourced valuable information on how regulations from different jurisdictions affect the use of blockchain technology with regard to data protection and privacy. As the created chains are operated and maintained in a decentralised network, the nodes forming that network may be located in different jurisdictions and can thus be subject to various data protection regulations. This decentralised situation results in a significant burden of verifying compliance of the blockchain-based solution as there is not only one particular data protection regulation to abide by, but potentially many other ones to follow. This is especially relevant for large public permissionless blockchains, where there is virtually no control over nodes joining the network from different countries. Generally, jurisdictions with comparatively high legal certainty are considered more attractive for innovative technology such as blockchain. In 9 out of the 14 regions (in- cluding the European Economic Area as a whole) assessed, there was a reasonable level of legal certainty. Across the remaining five regions, legal certainty was limited when this report was written. Both the United Kingdom and Russia were found to be the most regulated for blockchain purposes. While these regulations may provide le- gal clarity, they may also be highly restrictive. For example, Russia requires data to be stored domestically, which is not conducive to decentralised environments that span multiple countries. At the time of writing, multiple jurisdictions have recently implemented changes or are planning to implement changes regarding data protection legislation or other ad- jacent regulations. For example, the European Union’s Digital Finance Package which includes the proposed Regulation on Markets in Crypto-assets (MiCA) might have an effect on data protection aspects of asset-related blockchain technology. 2 Report on Data Privacy Regulations Applicable to Blockchain Technology in Various Jurisdictions Worldwide December 2020 2. Introduction Blockchains are shared, synchronised peer-to-peer digital databases that are main- tained by an algorithm and stored on multiple nodes. They form decentralised net- works. Eventually, blockchains become ledgers which may store different types of data, including personal data. When that is the case, various data protection regula- tions may become applicable to the blockchain technology, raising certain rights and obligations for different actors of the blockchain networks. The structure and nature of blockchains may potentially lead to numerous problems regarding data protection compliance, such as: (i) allocation of responsibility for com- pliance, (ii) principles of data minimisation and purpose limitation, (iii) exercising of data subjects rights, (iv) blockchains’ immutability, (v) anonymisation techniques or (vi) cross-border data transfers. As the created chains of blocks are operated and maintained in a decentralised net- work, the nodes forming that network may be located in different jurisdictions and thus be subject to multiple data protection regulations. Such a situation generates a significant burden of verifying compliance of the blockchain-based solution as it is not only one particular data protection regulation to abide by, but potentially multiple. This is especially relevant for large public permissionless blockchains, where there is virtually no control over nodes joining the network from different countries. Since it was implemented in May 2018, the EU’s General Data Protection Regulation (GDPR) generated significant commentary concerning its applicability to blockchain technology. For instance: The French DPA — CNIL (Commission nationale de l’informatique et des libertés), officially addressed the applicability of the GDPR to blockchain technology and its potential use-cases in a specific set of guidelines; 1 The EU Blockchain Observatory and Forum — an initiative sponsored by the Euro- pean Commission that provides analyses and discussion forums concerning block- chain technology — released a thematic report, “Blockchain and the GDPR”; 2 A study “Blockchain and the General Data Protection Regulation. Can distributed ledgers be squared with European data protection law?” was written at the re- quest of the Panel for the Future of Science and Technology (STOA) of the Secre- tariat of the European Parliament.3 Numerous scholars and experts in the field have similarly issued a number of other reports in this field. Surprisingly, however, there is limited written guidance about compliance with data protection regulations in other jurisdictions in terms of personal data stored on block- chains. The lack of a comprehensive overview of existing data protection regulations and their applicability to blockchain technology poses a significant challenge for fur- ther development of this cutting-edge technology. This report aims to address these concerns and provide the industry with an overview of data protection regulations in jurisdictions considered particularly important for the development of blockchain technology. In this report, the following were selected based on their relevance in the blockchain industry and crypto market: The European Union, Brazil, Canada, China, Hong Kong, India, Japan, Russia, Singapore, South Korea, Switzerland, Ukraine, United Kingdom and the United States. 1 https://www.cnil.fr/sites/default/files/atoms/files/blockchain_en.pdf. 2 https://www.eublockchainforum.eu/sites/default/files/reports/20181016_report_gdpr.pdf. 3 https://www.europarl.europa.eu/RegData/etudes/STUD/2019/634445/EPRS_STU(2019)634445_EN.pdf. 3 Report on Data Privacy Regulations Applicable to Blockchain Technology in Various Jurisdictions Worldwide December 2020 We also prepared the following set of questions to be answered based upon the laws of the jurisdictions included in the aforementioned list: 1. What are the legal acts regulating data privacy in your jurisdiction? 2. What authority(ies) are responsible for data protection and enforce the data pro- tection regulation(s)? 3. Have these authorities issued any specific regulation, guidance or opinions on blockchain? If yes, please summarize. 4. What kind of actors (e.g. data subjects, controllers, processors . .) do the applica- ble data protection regulations in your jurisdiction mention? Please provide legal definitions. 5. How does the applicable data privacy regulation define personal data and does it provide for different categories of personal data? 6. Does the applicable data privacy regulation define anonymisation and/or pseu- donymisation? 7. Is there any specific legislation that impacts blockchain technology in your juris- diction? Does it refer to data privacy? 8. Have any particular anonymisation or pseudonymisation techniques been ad- dressed by the data privacy authorities, courts or experts in your jurisdiction? Are they relevant for blockchain-based applications and architectures? 9. Is there a requirement to store personal data locally and how do international transfers work in your jurisdiction? 10. Is it necessary to notify processing activities to any authorities? 11. Can you describe what rights data subjects have under data privacy legislation in your jurisdiction? Does the right to be forgotten exist in your jurisdiction? 12. Which actors in the public permissionless blockchain network would be regulat- ed/responsible under the data privacy