# A Digital Currency Architecture for Privacy and Owner-Custodianship
## 2 Background
### Architectural Considerations
#### 2.3.2 Privacy by Design  
We suggest as a design requirement that retail CBDC users must have the right to privacy, with respect to not only asset custodians and other corporate actors but also the state. Law enforcement can ask custodians to carry out legitimate law-enforcement capabilities. However, it is too easy to assume that all of the information about a transaction should be available to law enforcement (or others) for their perusal upon request, and it has become an accepted practice for governments to leverage relationships between individuals and private-sector businesses to extract such information about their transactions. Figure 1: Taxonomy of digital money systems. Fortunately, it is possible to regulate financial transactions without collecting data that could be used to profile the behavior of individual persons. Features that can be applied on a case-by-case basis, such as limits to the size of withdrawals to anonymous destinations or limits to the size of remittances into accounts from private sources, can be implemented externally to the core architecture and managed by policy. We do not envision privacy as something that can be bolted on to a fully-traceable system (for example, with \"anonymity vouchers\" [22; 23]) or that can depend upon the security or protection offered by some third party. Were a CBDC designed not to provide certain qualities of privacy, some users, including those concerned about the risk of profiling or discrimination, would have reason to continue using less well-regulated methods to transact, including cash [24]. Moreover, there is demand for semi-anonymous means of payment [25], as well as for a variety of different instruments that can be used for payment, and, due to heterogeneity in the preferences of households, the use of a CBDC has immediate social value [26]. In the same statement mentioned in Section 2.2, [PERSON] also specifically acknowledged the importance and significance of preserving privacy, suggesting that an attempt to reduce the privacy of payments would \"inevitably raise social, political and legal issues\" [13]. This acknowledgement is important for three reasons. First, no digital currency, token-based or otherwise, would guarantee perfect anonymity in practice: consider the potential for timing attacks, software bugs, and limitations to operational security. Even bank notes do not achieve perfect anonymity: their serial numbers offer a possibility wherein individual notes can be tracked or marked, although to our knowledge such methods for surveillance are imperfect and seldom used. Nevertheless, we must consider the implications of systems that attempt to force users into payment systems with different anonymity properties and trade-offs in general. Second, we have an opportunity to demonstrate a system that can achieve and deliver a measure of true privacy, in contrast to problematic assumptions, such as the idea that the system must accommodate exceptional access or that privacy is not the starting point but rather something that should be protected by an authority [27]. Such a system, an example of which we describe in Section 3, would constitute an improvement over both the various government-backed digital currency systems that have been proposed to date (which are institutionally supportable but not private), as well as the various \"outside solutions\" involving _permissionless_ ledgers that are used in cryptocurrencies, such as Zcash and Monero (which are potentially private but not institutionally supportable). Third, privacy is sufficiently important that we should not rush headlong into creating infrastructure, or allowing infrastructure to be created, that might forcibly undermine it. In contrast to _data protection_, which is about preventing unauthorized use of data following its collection, _privacy_ is about preventing individuals (and in some cases businesses) from revealing information about their (legitimate) habits and behaviors in the first instance. Data protection is no substitute for privacy by design [9].