The (in)applicability of personal data protection law and the block- chain technology: initial reflections on the civil liability of the controller

Abstract

This paper aims at presenting initial reflections, in the light of the blockchain technology, on the impacts of personal data protection legislation; notably the EU General Data Protection Regulation and the Brazilian General Data Protection Act - Law No. 13.709 of 2018.The growing state regulation on personal data protection was designed for centralized technological systems. This fact has raised questions about the (in)applicability of regulation to decentralized structures, such as those introduced by blockchain, a technology with applicability in several domains. The investigation focuses on identifying the contours of the legal concept of controller, which acts jointly in the blockchain network with other controllers, with different degrees and qualifications. The legal issue focuses on the limits of the civil liability of each controller. Despite the personal data controller’s civil liability provisions in the mentioned legislation, there are still many doubts on the subject, especially when several people exercise control in a distributed manner.