The Role of BYOID in Meeting Requirements
With the deadline fast approaching to have solutions in place that comply with GDPR regulations, it’s predicted that 80 percent of companies won’t be ready. Blockchain technology offers a new, innovative and purpose-built way to meet the regulation’s requirements. Here’s what you need to know about blockchain-based identity management, BYOID and how they address the same principles and goals of GDPR.
The blockchain, the technology behind Bitcoin and cryptocurrency in general, has far-reaching applications. The underlying capabilities of the blockchain – that of a decentralized, immutable ledger – can be applied to multiple industries to protect data and identify information of users and companies and to meet compliance standards.
With the enforcement of the EU’s General Data Protection Regulation (GDPR) beginning on May 25, 2018, all companies processing or handling the personal data of persons residing in the EU, including U.S.-based companies, are searching for data-handling solutions that find innovative ways to comply with the new regulations. The GDPR is designed to give people more power over their own data, giving less to the organizations that collect and use it for monetary gain. Blockchain-based identity management enables the concept of “bring your own identity,” or BYOID, which aims to accomplish much of the same things as GDPR – giving back to users control over their data.
Predicted to Fail, Companies Search for Solutions
Because the legislation is so new, companies are still exploring what it will mean to be GDPR compliant. Forrester recently predicted that 80 percent of companies will fail to comply with GDPR in 2018. In a search for remedies, emerging blockchain solutions provide companies with ways to meet two of the regulations’ requirements: privacy by design and the right to erasure.
Blockchain Identity Management and Data
By using public/private key encryption and data hashing to safely store and exchange data via the blockchain, a person using a blockchain-based identity management (IM) system ensures their identity and data are stored on their device, where they are in control of which ID details to share. Using the blockchain allows third parties to validate that the original data or certification has not been changed or misrepresented.
Meeting Privacy by Design Requirements
With this method of IM, there is no need to store personally identifiable information (PII) in large databases, which are typical targets for hackers looking to steal as much data in as little time as possible. Data is kept on the user’s device, rather than with the company, and with no PII data to store, hackers no longer have a target to compromise. By incorporating blockchain-based IM directly into a company’s offerings and infrastructure, the technology helps companies meet GDPR’s requirements for privacy by design, a standard that requires companies to establish policies, procedures and systems that comply with the GDPR from the development and launch of a product or process.
Meeting Right to Erasure Requirements
Blockchain-based IM helps companies meet GDPR standards by allowing them to authenticate prospects, customers, contractors, employees, etc., without storing PII data. Without this data stored in the company’s systems, requests to access, erase and correct user data will be greatly reduced and, in some cases, eliminated entirely.
Under GDPR, organizations have to prove that consent was given to collect data on a person, and any data held must have an audit trail. Because blockchain-based solutions facilitate permission-based access of information, they leave an audit trail of consent on the blockchain. The user can remove that consent at any time, satisfying the GDPR’s right to erasure. The blockchain is only used to verify a user’s claim of their identity, and the blockchain is only populated with non-PII verification signatures.
Meeting both sets of requirements is a natural side effect of blockchain-based IM systems, as they were created to meet the same mission – increased autonomy over one’s own data. With this in mind, companies that choose this technology to comply with GDPR will take a step toward a society that values and protects our identifying data.
Armin Ebrahimi is Founder and CEO of 
