Blockchain and Privacy: The Challenges of Transparency and Innovation in Data Protection

A blockchain is a peer-to-peer network of nodes that uses a distributed ledger that can be used to track transactions involving value, including currency, votes, property, etc. The most widely known application of blockchain technology is Bitcoin. Transactions on a blockchain are not controlled by any central counterparty, and when individuals involved in a given transaction provide their information (including personal information), a record is created that can be verified by nodes in the network. In this sense, users who form a community can act as their own regulators.

In its openness, blockchain technology is full of new opportunities to transact in different ways. However, in the case of public blockchains, in order to allow security and certainty, each transaction is recorded on a publicly available ledger and the disclosed transaction information is immutable. The latter rule is the most fundamental one in the functioning of blockchain. Indeed, data can only be added to the blockchain, not deleted (because each node contains a copy of the blockchain). If this change is applied to a node, then this change will be rejected by the other nodes in the network. It provides a great deal of certainty in the time of the transaction chain. Changing a node would be like activating a time machine, and if changing the past without changing the present is impossible, the entire chain of information would be modified.

While the above makes sense from a technical perspective (and can even facilitate anti-money laundering measures), the immutable nature of blockchains can cause problems for those who wish to protect their privacy (including with regard to the nascent and evolving “right to be forgotten” recognized in some jurisdictions). For example, if the public information she provided to complete a transaction was wrong, or if the information she made public one day poses a significant risk to her safety, what should she do? Changes in people’s lives may trigger the need for them to change the information stored in the blockchain ledger, such as bankruptcy, criminal records, name change, gender change, etc.

So, given the decentralized nature of blockchain, how can a court order changes to the blockchain, just as it would order a web page to disappear from Google search results?

In this regard, a distinction should be made between anonymity and privacy. Some consider Bitcoin to be anonymous, if not private. In fact, the email address provided when registering for a Bitcoin transaction can be any email address, so a link to the user's personal information (such as his name or date of birth) can be avoided. However, Bitcoin is more accurately described as pseudo-anonymous. As the Privacy Commissioner's Office explains in one of its few publications on the topic of digital payments and privacy:

…some have suggested that virtual currencies can be used to make anonymous purchases. This is not necessarily true, as the digital trace associated with these currencies can still be tied to an individual, although the trace typically only includes transaction records, not personal information. However, to set up an account to use these virtual currencies, you may be required to provide some personal information, such as your name, credit card information, banking information, driver's license, utility bills, or even passport information. While the anonymity of digital currencies may limit the details associated with your payment information, retailers can still combine your purchase information with other information, such as your name, email address, purchase history, or your rewards/loyalty bonus points with the store.

While some technical solutions are being considered to address privacy challenges regarding the use of blockchains and the design of blockchains to protect privacy (such as encryption of data or the use of timestamps for information held elsewhere), there is still a potential benefit of regulatory guidance on privacy issues regarding blockchain technology.

To date, regulatory developments in Canada regarding digital currencies have been limited primarily to anti-money laundering and tax matters. However, Canada has seen growing interest in blockchain technology including from major financial institutions and the Bank of Canada, which is running experiments in interbank payment systems and, as Lieutenant Governor General Carolyn Wilkins put it, “building a proof-of-concept large-scale interbank payment system using a distributed ledger.”

In addition, certain securities regulators, such as the OSC and AMF, are establishing committees to consider financial technology matters. In this context, ensuring data protection associated with the use of blockchain technology may become an important regulatory consideration in the future.