ICO and personal data protection: European standards

Over the past two years, more than 2000 projects have been implemented by ICO. Almost all of companies collected personal information. For most projects, this information is the basis of the business model.
In Europe such projects are required to match the standards of the General Data Protection Regulation (GDPR). The rules apply to all ICO in which europeans participate, companies are offering their services in the EU or collecting information about europeans.

The GDPR is valid from 25 may 2018.

Usage of personal data in the blockchain projects
Let’s see where and how blockchain startups use personal data. There are four most common options:

• creation of a white-list, which records the data of investors;
• KYC compliance — collection data to confirm the identity of the investor;
• authorization in the personal account of the project;
• digital identification of the investor on the blockchain.

The first three options for the collection of personal data don’t caused questions, because here apply the same rules like in any e-commerce project.
The problem occurs when information adds to the blockchain. The technology doesn’t allow you to make changes to data chains or delete data on request.

How to solve the data problem in the blockchain
The GDPR rules apply to any personal data, but technically cannot be implemented in the blockchain. In order not to quarrel with regulators and not to wait for the law to adapt to the peculiarities of technology, you can take care of the issue in advance.
One option is to write only the key to the blockchain, which confirms personal data. Keep information separately. If you need to delete it, delete it, but the key in the blockchain will lose its function.

General requirements for ICO and blockchain startups
For ICO and blockchain startups, the requirements are the same as for other e-commerce projects:

• the transparency of the objectives for gathering information;
• consent to the processing of data;
• personal data protection;
• limited access to information prescribed in the rules for employees;
• the ability to remove or correct personal data upon request.