Blockchain and the GDPR: The French Data Protection Authority presents solutions for a responsible use of the blockchain

​The use of blockchain as increasingly important part of the personal data processing operations carried out by stakeholders raises the question of its compatibility with the GDPR, in particular the impact of blockchains on individual rights such as the right to privacy and the right to personal data protection.

For this reason, the CNIL has addressed this matter as one of the first authorities and provides an initial analysis and concrete solutions for a responsible use of blockchain in the context of personal data to the concerned stakeholders, especially from the health sector and financial institutions. Even though all blockchain projects do not involve personal data processing, many uses of blockchain necessitate to manipulate such data in terms of content as well as of information related to participants. Insofar, a blockchain can contain two types of personal data: participants’ and miners’ identifiers, which ensure the identification of the issuer and receiver of a transaction, as well as additional data contained “within” a transaction, that concerns natural persons who can be (in)directly identified.


In general, in order to not endanger personal data, the CNIL requests stakeholders to question the general need of using blockchain technology which, in some cases, raises issues regarding the GDPR, as well as the type of blockchain that will be used. The CNIL in particular recommends to carry out a data protection impact assessment in order to identify such cases in which other solutions for processing operations may be more suitable.

Concerning the identification of the data controller, according to the CNIL, the person deciding to register data on blockchain determines the purpose and means of data processing can therefore be considered as data controller. With respect to the exercise of rights, it is underlined the right of access and the right to portability can be exercised effectively, whereas the right to erasure, rectification and to object would require the evaluation of existing technological solutions.

The CNIL emphasizes that the challenges raised by blockchains regarding their compliance with fundamental freedoms and human right require a response at the European level. The CNIL, in this sense, will work cooperatively with its European counterparts and at the same time contact other French regulators as e.g. the Financial Markets Regulator, in order to establish a foundation for inter-regulation that will allow the stakeholders to better understand the responsible use of blockchains in the context of personal data.

Read more on the CNIL website (in English)