Blockchain-based Data Immutability and Traceability in the Era of GDPR

Blockchain technology and smart contracts have recently emerged as valid tools for implementing applications dealing with data due to their ability to provide immutability, traceability, and availability properties. However, in recent years, applications dealing with data need to comply with some data protection regulations, such as the GDPR in Europe. These regulations typically specify a set of rights for data subjects, like the right to be forgotten or the right to rectification, that are apparently in contrast with the blockchain properties mentioned above. This paper investigates how the eight data subject rights prescribed by the GDPR could be supported by a proper combination of blockchain, smart contracts, and encryption techniques. The discussion will proceed in an incremental way by describing how increased support for the GDPR rights requires increased sophistication of the provided solution.