GDPR expects it's citizens to have the 'right to be forgotten'. A company failing to fulfill this obligation is expected to pay a hefty fine. How will decentralized autonomous communities who store immutable data on the blockchain about its users deal with such a legal obligation?

Let's take the case of an alternative that EOS developers build for Facebook. They ought to store the users' names and other identifiable information on the blockchain, correct? What measures do they have to take to be compliant with the law? Should the founders remain anonymous so that nobody is held liable? Please talk about how social DACs can grow in such conditions.

2 Answers 2


All information in the blockchain is public and immutable by a definition.

If you store personal identity information on a blockchain, you are doing in wrong, regardless of GDPR or no GDPR. Building a dApp that stores personal identification information would just be stupid.


I would not say stupid, there are a lot usefully cases where u store personal data. Lets say an identity project or medical records, even a eos token transaction is under GDPR a violation. @ core-chain.io we try to put sensitive data into eos multi index tables, from there we are able to delete records (datable.erase(dataid);) Looking forward for some statements from GDPR.

  • 1
    There remains still the problem, that all transactional data from the tables is still stored in the transaction logs on all PB's. But in the persistent Storage it is deleted. Oct 31, 2018 at 14:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.