A Systematic Literature Review of the Tension between the GDPR and Public Blockchain Systems
A Systematic Literature Review of the Tension between the GDPR and Public Blockchain Systems
复制标题
DOI：
10.1016/j.bcra.2023.100129
复制
发表时间：
2022-10
期刊：
影响因子：
--
通讯作者：
Rahime Belen Sağlam;Enes ALTUNCU;Yang Lu;Shujun Li
中科院分区：
文献类型：
--
作者：
Rahime Belen Sağlam;Enes ALTUNCU;Yang Lu;Shujun Li
自2008年比特币发明以来，区块链技术一直在快速发展。最常见的区块链系统类型，即公共（无许可）区块链系统，具有一些独特的功能，导致与欧盟的通用数据保护条例（GDPR）和其他类似的数据保护法律之间的紧张关系。在本文中，我们报告了114篇讨论和/或解决这种紧张局势的研究论文的系统性文献综述（SLR）的结果。据我们所知，我们的SLR是对这种紧张局势的最全面的回顾，导致对这一重要主题的相关研究工作进行更深入和更广泛的分析。我们的研究结果揭示了三种主要类型的问题：（i）由于公共区块链的不可变性，难以行使数据主体的权利，如“被遗忘权”（RTBF）;（ii）难以确定公共区块链数据处理生态系统中的角色和责任（特别是关于数据控制者和数据处理者的识别）;以及（iii）由于区块链的分布式性质，相关法律的适用存在模糊性。我们的工作还使我们更好地了解了改善公共区块链系统GDPR合规性的解决方案。它不仅可以帮助区块链研究人员和开发人员，还可以帮助政策制定者和法律制定者考虑如何调和公共区块链系统和数据保护法（GDPR及其他）之间的紧张关系。
Blockchain technology has been rapidly growing since Bitcoin was invented in 2008. The most common type of blockchain system, public (permissionless) blockchain system, has some unique features that lead to a tension with the European Union’s General Data Protection Regulation (GDPR) and other similar data protection laws. In this paper, we report the results of a systematic literature review (SLR) on 114 research papers discussing and/or addressing such a tension. To the best of our knowledge, our SLR is the most comprehensive review of this tension, leading to a more in-depth and broader analysis of related research work on this important topic. Our results revealed three main types of issues: (i) difficulties in exercising data subjects’ rights such as the ‘right to be forgotten’ (RTBF) due to the immutable nature of public blockchains; (ii) difficulties in identifying roles and responsibilities in the public blockchain data processing ecosystem (particularly on the identification of data controllers and data processors); and (iii) ambiguities regarding the application of the relevant law(s) due to the distributed nature of blockchains. Our work also led to a better understanding of solutions for improving the GDPR compliance of public blockchain systems. It can help inform not only blockchain researchers and developers but also policymakers and law markers to consider how to reconcile the tension between public blockchain systems and data protection laws (the GDPR and beyond).