GDPR compliance about indy-sdk HOT 3 CLOSED

This has been a subject of a lot of discussion in the Identity WG and other places. Marta Piekarska is leading a collaborative effort to build out a paper on how Blockchains in general can address GDPR requirements here:
https://docs.google.com/document/d/1wnRYOZrGZS6h_-PnJRaq1pAc35GrfGUZcXh46sTHdFQ/edit#heading=h.xlkpssu5kfbq

Certainly we think that Indy's approach has many advantages when it comes to giving a user the ability to manage data sharing and meet GDPR requirements, but I am not aware of a paper that specifically addresses how Indy or an instance of Indy like Sovrin addresses GDPR requirements, but I could see how we could build out something very useful, and it would be a welcome contribution.

from indy-sdk.

I wrote an article about the greatest challenge, Right to Erasure: https://journal.tiiqu.com/open-questions-about-gdpr-compliance-in-the-context-of-blockchain-technologies-55f51860b048

While many properties of blockchain are great, this one is the most difficult to solve. It means that no personal data can be uploaded to the chain itself, only verifiers of personal data. The best way to link the verifier to the personal data would be ZKPs, simple hashes are considered pseudonymization, not anonymization, even though this opinion is questionable from a technical point of view (it is equivalent to say that good hashing can be backlinked or well encrypted data isn't private, the hacking procedures are the same...).

So if you implement ZKPs as verifiers on the legder for personal offchain identity data, then you will be in a great position:-)

from indy-sdk.

We are using Jira to track issues now, please use this Jira IS-996 ticket for any further discussion.

from indy-sdk.