A Blockchain-Based Solution for Defining and Enforcing Personal Data Access Policies

Driven by the increase in the availability of private information in digital format combined with the ever increasing interest in the use of this information for data mining and knowledge discovery, new regulations and standards are being created to protect private user information and achieve meaningful consent in the digital realm. Classical privacy enforcing solutions such as access-control-lists and non-standardized data sharing agreements are not capable of effectively covering the requirements set out by these new privacy regulations. At this same time, blockchain smart contracts have shown the possibility of representing various object types with user defined interaction rules, all of which can be unambiguously interpreted by machine. In this paper, we represent the private records of an individual as blockchain assets and demonstrate how this allows for a user to control access to their private records thus clarifying the user consent process and providing better regulatory compliance. We also present the design of a hardware wallet protocol which stores asset data and only reveals this data if blockchain transaction approval can be shown.