Foreword
Introduction
Scope
Normative references
Terms and definitions
Anonymity assessment
Approved security function
Architectural blueprint
Bitcoin
Cryptographic algorithm
Cryptographic key
Certificate
Decentralized application
Distributed ledger
Distributed ledger technology
Entity
Entropy
Ephemeral key
Hashed object
Hash value
Input data
Interoperability
IT System
Key management
Ledger
Off-chain
On-chain
Peer-to-peer
Privacy by Design
Organisational Measures
Pruning
Record
Security function
Technical Measures
Timestamp
Trust
Validation
Validator
Symbols and abbreviations
Personal data
Personal data in general
Defining Personal data
Practical consideration about identifiability and identifiers
Identifying personal data in a blockchain context
Requirement of an Anonymity assessment
GDPR awareness
Principles of data protection and their risks from the perspective of Privacy by Design
General
Fundamental principles of data protection
Assessing the risk of processing personal data
General
Traditional risk assessment methodology
Risk assessment from the perspective of data protection law
Initial assessment of risks in a blockchain application
Mitigating the risk of processing and decreasing identifiability through technical measures
General
Technical measures
Categories of technical measures of data protection:
Techniques to improve data protection or mitigate risk of processing
Architectural blueprint for an IT system processing personal data utilizing a blockchain-based tamper-proof access log
General
DLT-based tamper-proof access log
Decentralized Personal Data Storage
Consent Management System
Recommendations for handling personal data in blockchain applications (normativ)
GDPR awareness (normativ)
General
Controllership and processors in a BC/DLT-system
Right to Erasure (art. 17 GDPR)
Justifications for immutability
Right to rectification
Data Portability (art. 20 GDPR)
Processing Agreements between Controllers and Processors
Household exemption
Identification requirements for controllers
Personal data vs Privacy enhancing technology (ISO/IEC 27018)
Automated decision making (art. 22 GDPR)
Staff training + obligation (art. 29 and art. 32(4) GDPR)
Data protection impact assessment (art. 35 GDPR)
Documentation + record of processing activities (art. 5(2) GDPR)
Right to information (art. 13, 14 GDPR)
Data minimization (Art. 5 (1) lit. c GDPR)
Data Protection Officer (Art. 37 (1) GDPR)
Privacy by Design & Default
Notification of data breach to authorities and data subjects (art. 33/34 GDPR)
Right of access by the data subject
Right to object (art. 21 GDPR)
Transfer to third countries
Questionnaire: Extent of the implementation of data protection principles in a DLT, in particular blockchain solution (normativ)
Summary of applicable risk assessment methodologies (informativ)
Additional Information on Technical Measures (informativ)
Bibliography