Alexandra Giannopoulou’s research while affiliated with University of Amsterdam and other places

The concept of self-sovereign identity (SSI) describes an identity management system created to operate independently of third-party public or private actors, based on decentralised technological architectures, and designed to prioritise user security, privacy, individual autonomy and self-empowerment.

Various identity management solutions are emerging in different jurisdictions, with the goal of creating a unified and privacy-preserving identity management system bridging the offline with the online. Within this trend, the concept of self-sovereign identity has re-emerged. It is a concept attached to expressions of both individual autonomy and individual control (sovereignty)—an aspiration in direct relation to what blockchain is promised to bring in contemporary discourse. The paper will provide an overview of the current self-sovereign identity paradigm solutions within the technological environment that involves decentralized networks and it will trace some of the challenges it faces within the European Union especially with regards to the General Data Protection Regulation (EU) 2016/679 (GDPR).

Applications of algorithmically informed decisions are becoming entrenched in society, with data processing being their main process and ingredient. While these applications are progressively gaining momentum, established data protection and privacy rules have struggled to incorporate the particularities of data-intensive information societies. Consequently, there is a misalignment created between algorithmic processing of personal data and the corresponding regulatory frameworks since they both strive for meaningful control over personal data. However, the challenges to the traditional role and the concept of consent are particularly manifest. This article examines the transformation of consent in order to assess how the concept in itself as well as the applied models of consent can be reconciled to correspond not only to current data protection normative frameworks but also to algorithmic processing technologies. This particularly pressing area of safeguarding a fundamental aspect of individual control over personal data in the algorithmic era is interlinked with practical implementations of consent in the technology used. Moreover, it relates to adopted interpretations of the concept of consent, to the scope of application of personal data, as well as to the obligations enshrined in them. What makes consent efficient as a data protection tool? Can its previous glory be maintained within the current techno-legal challenges?

Blockchains and the GDPR pursue similar objectives where they seek to grant users greater control over their personal data. While the latter pursues this goal by imposing duties of care to centralized controllers and collectors of data, blockchains go a step beyond by trying to eliminate these stakeholders and the need to trust them. Nevertheless, the rules set out by the GDPR apply whenever personal data are at stake, and various actors of the blockchain ecosystem risk liability for controlling of processing data in violation of privacy requirements. A possible solution is to re-contextualize the concepts of data controlling and responsibility, as framed by the GDPR, in light of blockchains’ enhanced individual autonomy. In this paper, we set the framework for a further inquiry on the role of users as both data subjects and data controllers of distributed ledgers.