►
From YouTube: Panel Discussion: Is Blockchain GDPR Ready? - Moderated by Phillip Windley, Sovrin Foundation
Description
The European Union’s ("EU") General Data Protection Regulation ("GDPR"), which went into effect on 25 May 2018, is the most significant overhaul of EU data protection rules in 20 years. It imposes stringent requirements on companies that collect, store, or process data about EU data subjects, regardless of whether their systems are in the EU. This panel will outline some of the blockchain properties that represent challenges from a GDPR perspective, describes various approaches for readying blockchain solutions for GDPR, and outlines the need for a robust governance process. And, of course, we will talk about the right to erasure.
----
Hyperledger – Open Source Blockchain Technologies
Hyperledger is an open source community focused on developing a suite of stable frameworks, tools and libraries for enterprise-grade blockchain deployments.
It serves as a neutral home for various distributed ledger frameworks including Hyperledger Besu, Fabric, Sawtooth, Indy, as well as tools like Hyperledger Avalon, Cactus and libraries like Hyperledger Aries, Ursa. Learn more about Hyperledger projects: https://www.hyperledger.org/use
Case Studies: https://www.hyperledger.org/learn/case-studies
Training & Certification: https://www.hyperledger.org/learn/training
Tutorials: https://www.hyperledger.org/use/tutorials
Webinars: https://www.hyperledger.org/learn/webinars
Events: https://www.hyperledger.org/events
Vendor Directory: https://www.hyperledger.org/use/vendor-directory
Subscribe to the Hyperledger Newsletter: https://www.hyperledger.org/newsletter
Follow-us on Twitter @Hyperledger
Learn about Hyperledger Membership: https://www.hyperledger.org/about/join
#Hyperledger #HyperledgerGlobalForum2018 #Blockchain
A
Good
morning,
everyone
welcome
to
the
panel
discussion.
The
topic
of
our
panel
today
is
blockchain
and
GPR,
and
specifically
the
challenges
that
we
face
when
we
combine
those
two
things:
I
think
that
most
people
have
probably
heard
of
GDP
are,
you
know
at
least
you've
all
run
into
lots
of
banners
on
the
bottoms
of
the
webpages.
A
You
go
to
asking
you
to
consent
to
use
of
cookies,
but
I
think
today
we're
going
to
get
into
some
of
the
details
of
why
GDP
are
and
blockchains
have
some
conflict
and
how
we
can
help
them
get
along
better
together.
So
let
panelists
introduce
themselves
and
talk
a
little
bit
about
what
they're
doing
why
they
came
to
this
just
for
a
minute
or
two
and
then
we'll
get
right
into
it.
So.
B
C
Hi
everyone,
my
name,
is
Joe
Hockey
I'm
principal
at
promontory,
Financial
Group,
which
is
a
wholly
owned
subsidiary
of
IBM.
We're
a
global
regulatory,
consulting
firm
I
work
in
our
London
office,
where
we
focus
on
data
privacy
and
data
protection
issues,
and
my
practice
focuses
on
the
overlap
of
gdpr
and
blockchain
have
been
working
with
many
of
our
IBM
colleagues
and
clients,
their
implementations
and
the
concerns
that
that
you
know
their
implementations
of
blockchain
have
with
regard
to
GPR.
C
D
Hi
good
morning
my
name
is
Sylvia
Rodriguez
I'm,
a
lawyer
also
in
Spain
and
in
the
state
of
New
York
I'm
also
certified
in
that
a
protection
loss,
data
protection,
privacy
laws
in
Europe
and
I'm.
An
independent
consultant
I
work
independently
right
now,
I'm
very
interested
in
the
intersection
between
the
law
and
high-tech
markets
in
general.
Now,
especially
blockchain.
E
Good
morning,
everyone
thank
you
for
coming.
I
Miguel
Sanchez
and
Solutions
Architect,
and
also
an
independent
consultant
I
implement
solutions
for
large
organizations
in
the
US
I'm,
also
certified
by
the
internationalization
of
Privacy,
Protection,
profession,
privacy,
professional
in
terms
of
European
regulation
and
right
now,
since
2007
team
I'm
into
the
blockchain
ecosystem
and
specifically
Hyperloop
technologies.
Well,.
A
A
C
Sure
I'm
happy
too
so
there's
a
number
of
reasons.
Why
why
gdpr
is
relevant
to
blockchain
and
and
I?
Think
one
of
the
things
that
you
know
I
spend
a
lot
of
my
time
talking
with
client
and
clients
and
potential
clients
about
is
just
some
misconceptions,
I
think
there's
you
know,
there's
a
belief
out
there
that
that
GD,
P,
R
and
blockchain
are
mutually
exclusive,
that
they
are
not
compatible,
and
you
know
I
think
there
are
a
number
of
sort
of
big
banner
headlines
of
why
that
could
be.
C
For
example,
you
know
the
GD
P
R
has
a
this
right
to
be
forgotten.
You
know
the
there
must
be
the
ability
to
rectify
personal
data
on
any
given
system.
There
must
be
the
ability
to
remove
that
data
if
requested,
which
you
know,
seems
to
butt
heads
with
with
you
know:
the
block
chains,
inability
excuse
me,
the
immutability
and
and
so
there's
this
question
of
whether
you
can
put
personal
information
on
a
blockchain,
which
you
know
for
a
lot
of
solution.
C
Architects
will
create
problems
and
really
limits
the
use
cases,
but
I
do
think
that
there
are.
There
are
opportunities
here
to
you,
know,
make
these
make
these
two
seemingly
antithetical
things
work
together,
and
I
and
I
think
that
I
think
that
just
takes
a
little
bit
of
creativity.
It
takes
a
little
bit
of
understanding
of
what
the
GD
P
are
actually
requires
of
you
and,
and
an
understanding
of
you
know
how
to
how
to
work.
Your
solution
to
meet
those
requirements
and.
D
I
will
also
add
that
the
GDP
are
the
territory
scope
of
the
GD
P
R,
it's
very
broad
and
it
touches
everyone
should
be
noticing
or
giving
an
important
study
P
R,
because
it
touches
any
any
establishment.
Any
entity
that
wants
to
offer
goods
answer
to
the
you
EU
residents
and
citizens
and
with
the
intent
to
do
it
or
to
monitor
citizens
or
residents
in
the
EU.
So
almost
any
company
outside
of
Europe
could
be
touched
by
the
GDP
are,
and
their
very
high
fines.
A
That's
a
that's
a
great
point
that
it's
relevant
to
almost
everybody
and
it's
impossible
to
to
get
away
from
so
the
the
the
GDP
are
Joe.
You
mentioned
the
the
right
to
be
forgotten,
and
that
implies
that
there's
somebody
you
can
contact
to
ask
to
be
forgotten,
and
you
know
that
somebody
is
the
the
data
control
earners
are
so
data
processors,
somebody
Daniel.
Maybe
you
are
sorry
McHale.
Do
you
like
to
talk
to
us
about
that
about
the
roles
and
and
how
they
come
into
play?
Yeah.
E
Well,
first
of
all
people,
when
we
talk
about
the
right
of
a
ratio,
we
think
that
is
like
there's
no
way
to
escape
from
that,
and
actually
there
are
several
exceptions
and
actually
most
of
the
cases
you
can
say.
Well,
you
actually
don't
need
to
remove
the
entire
data
and
in
terms
of
the
blockchain,
the
one
thing
that
we
should
discuss
is
what
actually
means
right
operation
and
what?
What
is
the
information
that
you
can
or
you
should
delete,
and
it's
just
only
personal
data.
It's
not
any
data.
E
So
if
you
have
data
about
an
organization,
there's
no
such
thing
about
right
operation,
we're
talking
about
personal
data
that
is
related
to
a
natural
person.
That's
the
first
thing.
Maybe
we
can
discuss
about
personal
data,
and
the
thing
is
even
though
you
would
like
to
remove
that
data.
They
control
it.
I
mean
the
organization
that
is
managing
your
data
could
find
a
way
workarounds.
We
can
say
that
to
not
do
it
or
in
as
a
last
resort,
somehow
from
the
technical
perspective
prepared
the
data.
E
So
it's
pretty
much
deleted
erased
in
terms
of
accessibility
or
in
terms
of
readability.
So
people
are
very
scared
about
the
right
of
eurasia.
I
mean
innovators,
like
oh
I'm,
going
to
put
something
that
you
know
it's
immutable
I
can
remove
it
from
watching,
but
the
thing
is
I
mean
if
you,
if
you
think
in
advance
and
you
design
properly
and
apply
the
technology
that
is
currently
available.
You
don't
really
need
to
be
scared
about
that.
Of
course,
you
should
be
very
careful
in
that
area.
I.
C
Would
just
add
to
that
that
you
know
I,
think
that
controllers
the
controller
process
for
relationship
is
one
of
the
you
know,
kind
of
major
outstanding
questions
when
it
comes
to
designing
GDP
are
compliant
blockchain
solutions
and
sorry
I'm,
not
really
sure
sort
of
what
the
what
the
audience
background
is
with
the
GPR.
So
one
of
the
challenging
things
about
gdpr
is
just
there's
a
lot
of
definitions
that
we
need
to
get
through
when
it
comes
to
controller
and
processor.
C
The
controller
in
in
any
given
analysis
will
be
the
entity
that
is
gathering
or
processing
personal
data
that
controls
both
the
means
and
the
purposes
of
that
processing
and
it
comes
with
a
whole
bunch
of
obligations,
requirements
that
are,
in
contrast
to
being
being
considered,
the
processor,
which
is
where
you
are
processing
data,
but
you
do
not
control
the
purposes,
so
you
are
processing
on
behalf
of
another
entity.
So
generally,
that's
pretty
straightforward.
C
All
right
like
if
you
know
you
are,
if
you
are
Google
and
you
are
gathering
personal
information,
you
are
doing
that
as
a
controller.
You
are
gathering
that
information
for
your
own
purposes
when
it
comes
to
a
blockchain
solution
where
there
are
many
nodes
on
network
and
all
of
those
nodes
contain
personal
data,
but
are
not
not
necessarily
using
it
thick.
The
distinction
between
controller
and
processor
becomes
a
little
bit
more
murky
and
so
figuring
out.
Who
are
the
controllers?
C
Who
are
the
processors
whether
there
are
joint
controllers,
becomes
a
little
bit
more
of
a
complex
analysis
in
the
case
of
blockchain?
And
then,
of
course,
you
get
into
distinctions
between
public
versus
private
chains,
permission
versus
permission
lists,
and
so
there's
there's
a
whole
analysis,
though.
C
That
needs
to
be
done
with
significant
implications
for
for
the
entity
that
is
either
setting
up
the
blockchain
in
the
first
place
or
existing
as
a
node
on
it,
because
many
entities
can
end
up
getting
additional
responsibilities
under
the
gdpr
that
they
didn't
bargain
for
when
they,
when
they
sort
of
signed
up
to
the
network.
Just.
E
One
little
thing:
I
don't
want
to
hijack
the
conversation.
I
will
just
want
to
add
a
little
example
to
to
make
it
clear.
What's
the
controllers,
so
let's
say
you
have
a
fabric
network
and
all
the
but
I
mean
private
permissions
blockchain.
So
all
the
participants
are
going
to
be
considered
controllers,
so
they
have
the
responsibilities
from
gdpr
perspective
unless
there
is
a
designated
controller,
and
even
though,
if
you
are
the
controller
of
the
whole
network,
the
whole
blockchain
I
mean
because
you
determine
the
purpose
in
the
means
of
the
processing.
E
You
can
find
also
another
controller
at
another
level.
This
is
based
on
a
new
Observatory
reports
and
French
data
protection
reports
and
combined
with
the
residual
18.
So
whenever
a
participant
of
the
network
submits
information
on
the
lecture
is
automatically
considered
a
controller,
but
automatically
could
be
considered
a
controller
if
there
is
a
business
activity
vault,
which
means
that
you're
going
to
have
two
controllers,
there
are
not
join
controllers,
different
levels
or
you
have
hi
per
layer
Network.
If
you
have
a
channel
between
two
participants,
they
are
going
to
be
controls
of
that
information.
E
They
are
managing
between
them
and
then,
at
the
same
time,
you
have
controllers
for
the
entire
network.
So
it's,
as
you
said,
Joe
it's
difficult
to
find
out
exactly
what
is
a
controller,
but
at
the
end
you
have
to
find
the
factual
circumstances
and
and
to
look
at
that
and
determine
that
so
giving
you
that
example
about
hyper
layer,
I
think
for
permissioned,
Private
Network,
it's
it
could
be
more.
It
could
be
easier
than
public,
but
regardless
that
at
the
end
there
should
be
a
controller
behind
blockchain
and
that's
their
example.
B
So
you
know
if
anybody
is
trying
to
build
a
production,
blockchain
solution,
and
you
know
you
go
and
try
to
build
a
consortium
or
invite
some
people
to
use
your
Vblock
seen
as
a
service.
One
of
the
that
whole
thing
has
to
go
and
be
vetted
by
the
client
team,
including
their
security
and
compliance
teams
and
others.
One
of
the
first
questions
they
would
ask
is:
are
you
gdpr
compliant
and
if
there's
any
production
solution
on
blockchain?
That
says
we
are
not.
B
You
know,
that's
a
deal-breaker,
so
why
GDP
are
important,
because
you're
trying
to
sign
up
clients
that
is
a
deal
breaker
and,
of
course,
there's
the
whole
personal
data
aspect
to
that.
So
you
know
when
trying
to
sort
of
create
these
production,
blockchain
solutions
or
hyper
larger
fabric
or
any
of
the
blockchain
platform.
What
has
to
sort
of
abstract
things
out-
and
you
know,
keep
keep
in
mind
as
to
what
are
some
of
the
important
things.
B
A
data
collection
is
one
one
aspect
which
I
think
Miguel
and
Joe
alluded
to
who's
the
data
controller,
who
acquires
the
data
who
processes
the
data,
so
example,
a
bank
may
acquire
the
data
and
may
process
it
on
on
a
cloud
hands.
The
controller
and
the
processor.
No,
but
blockchain
at
its
core
is
a
immutable
database,
immutable
ledger,
it's
it
stores
things
permanently
and
it
stores
things
in
a
distributed
manner.
Right
and
the
GDP
art
says
that
you
know
you
have
to
have
a
right
of
erasure.
B
You
need
to
give
the
people
the
right
to
modify
things
and,
if
you're
going
to
share
that
information,
you
have
to
tell
people
who
you
are
sharing
this
information
with
right.
So
that's
that
sort
of
the
dichotomy
in
a
nutshell.
So
if
you
have
to
be
able
to
explain
to
clients
in
very
simple
terms
that
aim
if
we
are
processing
personal
data,
are
we
processing
that
person
later
off
chain
or
on
chain
on
blockchain?
It
is
usually
a
good
idea.
You
know,
if
you
don't
know
anything
about
GDP
our.
B
You
know
it's
generally
a
good
idea
to
start
with
by
by
trying
to
avoid
storing
personal
data
on
blockchain
right,
but
then
you
may
ask
the
question:
how
is
that
possible
can
I
can
I
build
a
production
solution
with
without
doing
that?
So
what
are
some
of
the
other
techniques
that
that
could
be
used?
And
you
know
the
techniques
come
into
mind
such
as
hashing
or
pseudonymous
Asian?
You
know
which
need
to
be
vetted
as
part
of
the
GDP.
B
Our
readiness,
because
a
simple
hash
of
let's
say
a
name
and
putting
that
on
on
blockchain,
is
simply
not
good
enough.
It
it
does
it.
You
know
it
does
not
provide
it.
Conflicts
for
the
right,
with
the
various
properties
I
outlined
earlier,
in
terms
of
erasure,
rectification
and
notification
before
distribution
of
of
information
and
on
fabric
I,
also
another
in
a
permission,
blockchain
platforms,
I
think
it
has
also
been
alluded
that
you
know
implementing
gdpr
is
slightly
easier.
Then
then,
then
public
blockchain
networks,
but
nevertheless
you
know
there's.
B
There
is
also
the
issue
of
liability
contractor
liability
that
comes
into
play.
So,
for
example,
if
you,
if
one
of
the
nodes
or
organisations
acquired
the
data
from
from
some
personal
personal
data
from
some
entity,
shared
it
with
one
of
the
other
organizations
on
our
own
hyper
larger
fabric,
you
know
maybe
an
on
amazed
fashion
and
imagine,
if
not
all,
of
the
nodes
have
the
same
security
control.
So
one
of
the
other
organizations
gets
compromised.
Then.
B
What
is
that
the
liability
of
that
organization
which
are
participating
in
a
fabric
channel
or
in
a
block
G
network
to
the
data
controller?
And
what
is
the
data
controller's
liability
to
to
the
end
user?
These
are
all
important
questions
that
you
know
that
need
to
be
figured
out
or
I
have
to
be
figured
out
before
a
production
solution
you
know
comes
into
play.
I
would
also
mention
that
there
is
also
a
question
comes
up.
B
B
You
know
real
estate
transactions
come
to
mind
because
I'm
not
giving
any
legal
advice
here,
so
that
I
think
that
also
needs
to
be
clarified
as
the
community
as
a
whole
and
also
by
the
you
know,
European
Data
Protection
Board
as
to
what
are
the
various
classes
of
data,
a
personal
data
in
particular
that
you
know
have
the
appropriate
attributes
or
that
need
to
have
the
properties
of
rectification,
modification
and
innervation.
Thank.
A
You
so
I
suspect
your
audience
is
a
mixture
of
business
and
technical
folks
probably
aren't
a
lot
of
policy
wonks
out
there
that
get
up
every
morning.
Thinking,
oh,
let
me
read
the
latest
on
on
this
law
or
regulation.
So
with
that
in
mind
from
a
business
side
from
a
technical
side,
what
can
people
who
are
building
block
chain
solutions
do
to
think
about?
Gdp
are
from
the
start,
because
it's
clearly
not
something
you
can
just
address
at
the
end
and
you
know
take
a
few
measures.
A
D
Well,
I,
don't
know
well,
first
of
all
and
the
gdpr
have
some
principles:
privacy
by
design,
it's
one
of
them
and
from
the
beginning
of
the
development
of
the
project,
you
should
think
about
the
protection
of
the
data.
What
data
are
you
gonna
put
if
you
are
gonna,
put
some
data
on
the
ledger
and,
as
Salman
said,
it's
not
advisable
to
put
personal
data
on
a
ledger
at
least
at
for
now
it's
not
advisable,
and
you
should
take
that
into
consideration.
D
Also
data
minimization
that
you
should
really
think
about
what
information
do
you
really
need
from
the
data
subject
and
try
to
minimize
that
as
much
as
possible
and
having
that
data
stored
for
the
last
amount
of
time?
So
you
are
protecting
yourself,
so
you
have
to
keep
in
mind
the
consumer
protection.
In
the
end,
it's
gonna
be
crucial
when
you're
building
your
project.
C
Yeah
I
agree
with
everything
that
Silvia
just
said
and
and
would
add,
there's
there's
probably
sort
of
there's.
Probably
an
initial
sort
of
threshold
question
which
is
is:
is
this
even
something
I
need?
Do
I
need
a
blockchain
to
build
my
solution,
and
if
yes,
then
you
say,
okay,
what
kind
of
data
will
be
stored
on
the
blockchain?
As
we've
all
said,
you
know
the
the
preference
is
to
not
store
personal
data
on
the
blockchain
to
begin
with,
because
if
you
don't,
you
know,
you're
going
to
you're
gonna
run
into
some
of
these
tricky
questions.
C
So
so,
once
you're
into
this
world,
where
you
have
a
blockchain,
you
have
personal
data
and
then
all
of
the
questions
that
still
we
just
mentioned
are
really
right
and
you
need
to
think
about.
You
know,
privacy,
by
design
principle.
You
need
to
think
about
data
minimization.
All
of
these
things
once
you've
sort
of
sorted.
C
Do
customers
have
access
to
this
data
if
somebody
needs
to
access
their
data
or
change
their
information,
or
you
know
just
inquire
about
their
information,
who
are
they
gonna
reach
out
to
who
are
they
going
to
talk
to
and
and
how
are
issues
going
to
get
escalated
up
the
chain?
So
these
are
all
things
that
you
know:
companies
need
to
be
thinking
about
when
designing
any
solution,
but
certainly
when
it
comes
to
something
as
complicated
as
as
a
blockchain
implementation.
These
are
things
that
you
need
to
be
thought
about.
Thanks,.
A
D
Will
point
out
that
the
gdpr
provides
a
figure
that
is
the
data
protection
officer
and
in
some
instances,
especially
do
you
if
the
companies
you
have
had
as
a
protection
officer?
It's
not
that
it's
a
must
but
I
think
it's
a
good
starting
point,
because
that
figure
will
know
the
gdpr
inside
an
and
he
will
know
your
organization.
I
will
help
you
navigate
through
through
the
gdpr
and
it's
an
advisor.
It
has
to
be
independent
from
the
company
company
and
it's
supposed
to
be
an
advocate
for
the
further
data
subject.
A
E
In
terms
of
territorial
scope,
but
apart
from
that,
it's
pretty
much
the
same
as
the
directive.
What
it
brought
was
the
regulation
across
all
the
European
Union,
because
at
the
at
the
beginning
we
had
the
directive,
but
you
know
every
single
state
was
pretty
much
doing
their
own
regulation.
So
now
it's
going
to
be
just
a
unified
regulation.
But
apart
from
that,
just
to
answer
your
question,
what
we
are
seeing
right
now
in
the
world
is
these
companies
are
struggling
with.
E
Gdp
are
because
pretty
much
what
they
have
to
do
is
meet
the
higher
standard
and
right
now,
I
think
GDP
are,
is
the
highest
standard
in
terms
of
data
protection,
so
I
think
we're
going
to
see
that
companies
around
the
world
trace,
adopting
GDP
are
and
other
jurisdiction.
Creating
and
regulating
in
a
similar
way
at
gdpr
is
doing
that's
my
opinion.
I
think.
B
Is
data
privacy,
a
fund,
a
fundamental
human
right
that
needs
to
be
enshrined
in
perhaps
as
part
of
the
UN
Millennium
Goals
as
part
of
some
UN
charters
that
has
been
certified
and
ratified
by
all
the
countries,
so
I
think
one
of
the
fundamental
conclusions
least
in
my
opinion
of
GDP
RS,
is
raising
that
level
that
awareness
that
that
was
needed
for
the
protection
of
of
personal
data.
But
we
are
not
done
and
we
will
not
be
done
until
we
have
of
agreed-upon
principles.
B
A
F
F
As
Miguel
said,
gdpr
was
started
to
come
into
into
the
game
in
2012.
We
see
it
now
in
2017,
a
lot
of
years
have
passed
a
lot
of
technological
advancement.
What
are
our
organizations
like
IBM
doing
to
update
these
already
outdated
regulation,
because
what
I
see
when
I
look
at
GDP
RS
I
see
a
lid
of
a
lot
of
good
willing,
a
lot
of
hope,
but
that
it's
already
outdated?
We
are
not
correct.
F
F
Therefore,
I
think
that
people
in
the
space
people
in
the
industry
we
need
to
participate
actively
into
kind
of
the
conversation
into
where
us
feel
was
saying.
Where
does
GDP
GDP
are
go
and
how
is
gonna,
because
I
think
that
right
now,
sorry
I'm
very
long.
My
thing
right
now,
a
lot
of
what
we
are
doing
is
trying
to
feed
our
solutions
to
GDP
are,
and
it's
like
I
think
this
is
kind
of
a
backward
mentality.
We
need
to
continue
advancing
and
regulation
needs
to
come
with
us.
B
So
I
mean
I,
think
I
agree
with
what
what
you
said
and
you
know,
regulations
have
to
be
updated
to
reflect
the
current
state
and,
as
people
are
rolling
out,
compliance
with
GDP.
Our
people
are
also
realizing
the
cost
of
that
and
one
on
one
hand
there
is,
you
know,
privacy
and
a
protection
of
personal
data.
B
On
the
other
hand,
you
know
there
is
the
cost
of
doing
at
that,
and
there's
also
the
concern
that
are
we
opening
some
new
potential
holes
or
or
are
creating
new
sort
of
silos
of
person
Zeta,
where
all
the
personal
data
is
stored
in
one
place
because
of
gdpr,
and
therefore
our
attackers
know
where
to
go
and
and
potentially
get
it
which
it
can
be
better
protected.
Also,
but
you
know
also
raises
its
own
set
of
concerns.
B
D
I
think
that
they
use
making
steps.
Obviously,
regulators
are
going
always
lower
than
technology.
We
have
the
EU
blockchain
observatory
and
forum
where
they
are
creating
working
groups
and
forums
for
the
community
to
talk
and
chat
and
present
problems
and
solutions.
Also
they're
going
to
establish
the
blockchain
European
blockchain
partnership
and
next
year,
they're
going
to
establish
an
international
partnership
or
Association
of
blocking
application.
That
is
a
collaboration
between
the
public
and
private
institutions.
D
There's
a
lot
of
banks
there,
so
they
are
taking
taking
step
to
learn
about
the
technology
and
I
think
in
that
sense
the
regulatory
sandboxes
are
a
good
option.
We
have
seen
regulatory
sign
boxes
in
the
UK
within
the
FinTech
industry
and
they
have
been
very
successful
programs.
So
I
think
it
could
be
a
good
idea
for
a
collaboration
between
the
innovators
and
the
regular
to
learn
from
each
other
from
the
innovators
to
educate
the
regulator's
and
at
the
same
time
the
regulator's
can
learn.
D
What
are
the
patterns
in
the
in
the
technology
that
they
could
be
implemented
to
some
legal
guidelines
and,
of
course,
in
the
European
Union.
The
the
public
policy
is
to
have
the
regulation
technologically
neutral,
so
it
is
not
the
policy
to
a
specify
or
to
do
a
regulation
about
a
super
specific
technology
and
just
to
be
a
little
bit
more
neutral
so
that
you
can
protect
the
rights
of
the
citizens
in
any
technology,
but
I
think
step
are
being
taken.
D
But
of
course
it's
gonna
be
a
slow
process
to
reach
to
a
place
where
you
can
amend
or
do
or
do
new
legal
guidelines.
I.
Think
that
sense
also
like
we
have
her
blockchain
it's
in
its
early
stages,
so
I
think
that
in
the
end
they
will
wait
and
continue
to
learn
before
they
take
steps
towards
I
mean
mean
amending
the
regulation
or
doing
some
legal
advances.
In
that
sense,
thank.
G
B
Think
that
self,
where
what
are
the
various
techniques
that
can
be
used
to
store
personal
data
on
it?
First
of
all
don't
store
personal
data
on
chain,
and
you
know
if
it
is
unavoidable,
you
know
one
can
use
various
pseudonym
ization
techniques,
and
so
what
are
those
sudhana
magician
techniques
and,
more
importantly,
have
those
pseudonymous
asian
techniques
been
vetted
by?
B
You
know
the
GDP,
our
folks
commissions
in
the
EU,
in
the
absence
of
that
we
can,
you
know,
1k
from
a
solution
perspective
from
a
blockage
in
solution
perspective
and
can
take
a
very
conservative
approach
to
make
to
ensure
forward
compliance.
Your
future
compliance,
but
you
know
there
are
some
clear
anti
patterns.
You
know
don't
encrypt
personal
data
in
store
on
blockchain,
because
encryption
can
be
broken
future
and
you
cannot
have
the
deletion.
You
know
don't
CPU.
Do
a
hash
and
I
think
beyond
that,
it's
more
of
a
discussion,
more
of
a
careful
engineering.
E
Yeah
I
would
like
to
add
something
to
that.
So
actually
you
can
store
anything
on
blockchain
I
mean
it's
about
what
and
how
are
you
going
to
manage
that
the
thing
about
personal
data,
because,
from
regulator
perspective,
personal
data,
is
not
just
your
name
or
where
you
live,
I
mean
it's.
It
could
be
pretty
much
anything
that
can
identify
you.
So
we
heard
about
Bitcoin
and
public
keys
and
public
keys
in
some
cases
being
considered.
E
Private
personal
data
so
said
that
I
have
to
say
that,
even
though
you're
managing
personal
data
and
it's
on
the
chain,
even
plaintext
again
as
I
said
at
the
beginning,
that
doesn't
mean
that
you
have
for
sure
to
deal
with
right
of
a
ratio,
but
it's
completely
unadvisable.
Just
someone
said
I
mean
even
if
you
encrypt
the
data,
even
in
the
future,
you
can
expose
some
personal
data.
That
is
very
much.
It
could
be
a
problem,
but
it's
going
to
be
case
by
case,
but
the
answer
to
Shirin
says:
yes,
you
can
do
it.
E
You
had
to
handle
that
in
the
the
right
way,
but
it's
not
like
I
mean
I
want
to
say
this.
It's
not
like
you
can
not
information
that
change.
I
know
people
think,
but
if
I
can
not
store
public
keys,
why
I'm
using
blockchain?
What's
the
point
of
blocking
if
I
have
to
store
information
off
chain?
Yes,
you're
right,
but
at
the
end
you
had
to
manage
the
revelation.
E
H
It's
actually
triggered
by
what
you
just
said,
and
it's
not
specific
to
two
sovereign,
but
any
self
sovereign
identity
system
and
wants
to
use
blockchain.
The
number
one
problem
we're
solving
for
an
individual
is
to
make
their
assertions
about
their
own
data
and
their
ability
to
share
and
credentials
safe
right
with
with
cryptography.
So,
therefore,
it
is
about
sharing
of
the
public
key
which,
as
I
understand,
it
is
absolutely
considered
personal
data.
It's.
E
Considered
this
is
tricky
part
and
actually
I
mean
I.
Disagree
with
regulators
to
be
honest,
public
key
by
itself
doesn't
identify
I
mean
you
cannot
say
anything
about
yourself,
but
if
you
combine
that
information
with
even
third
party
organizations,
information
and
actually
there's
a
case
about
dynamic
IPs
and
somebody
complaining,
hey
I,
don't
have
the
the
information
from
the
internet
service
provider
yeah.
But
if
you
combine
that
information
where
the
IPS
are
you
raised
him
from
the
users
that
are
in
your
webpage,
then
you
can
pretty
much
identify
them.
E
H
Let
me
let
me
sharpen
that
question.
Let's
say
an
individual
decides
who
use
that
public
key
to
enter
relationships
and
share
information
where,
in
that
context,
that
it
will
be
identifiable,
but
what
we've
done
is
provided
them
with
utility
to
share
that
data
under
their
control
in
a
safe
way.
Do
you
believe
the
EU
Commission
will
ultimately
decide
that
that
use
of
an
immutable
public
ledger
is,
is
worth
it
and
assigned
with
their
goals?
Even
if
you
couldn't
go
and-
and
you
know,
erase
the
data
from
an
immutable
ledger
well,.
B
I
can
make
a
strong
statement.
I
think
it
will
be
a
mistake
on
part
of
--use
Commission
to
let's
say
it
could
say
that
you
know
the
the
software
or
any
of
this
disability
identity
network
needs
to
be
shut
down
because
they
are
providing
a
way
of
for
sharing
public
keys,
but
I
think
at
the
same
time
you
know
hum,
as
we
always
know,
not
the
only
the
how
about
the
goodness
the
business
value
is
derived
from
linking
of
data
right.
We
all
do
that.
B
We,
you
know,
we've
built
cloud
systems,
we
link
CPU
data
with
them
data
to
derive
some
information,
but
you
know
the
same
thing:
men
turn
on
personal
data
can
be
used
for
harm
and
I.
Think
that's
that's
the
gray
area
right
where
there
are
no
clear
answers
and
that's
something
that
has
to
be
figured
out.
Thank.
A
A
You
know,
I
I,
think
it's
easy
when
we're
in
the
heat
of
the
moment,
trying
to
design
the
system
that
we
just
know
is
going
to
add
so
much
value
to
people's
lives,
to
think
about
GDP,
our
and
privacy
in
general.
As
a
barrier,
we
have
to
overcome
something
that
is
standing
in
the
way
of
us,
bringing
all
this
great
value
to
people
right,
they're,
just
gonna
love
our
ads
or
whatever.
It
is
we're
doing.
A
I
teach
a
class
at
BYU
on
decentralized
systems
and
at
the
end
of
that
class
I
tell
my
students
that
they
have
an
obligation
to
build
the
world
that
they
want
to
live
in
and
I.
Think
all
of
us
have
that
same
obligation
as
we're
designing
blockchain
solutions.
We
need
to
build
solutions
that
enhance
human
dignity
and
to
do
that.