# Challenges of Using Blockchain in the Education Sector: A Literature Review
## 3 Results
### Challenge 10: Legal Issues and the Lack of Regulatory Compliance  
One article [11] reported the legal issues and/or lack of regulatory compliance as a challenge. The European General Data Protection Regulation (GDPR) [46], for example, states that citizens have the \"right to be forgotten,\" which is incompatible with the blockchain's immutability [11].  
[PERSON] and [PERSON] [49] discuss two key GDPR principles that are related to blockchain technologies. The first indicates that \"in relation to each personal data point, there is at least one natural or legal person--the data controller--whom data subjects can address to enforce their rights under EU data protection law. These data controllers must comply with the GDPR's obligations.\" [49]. When it comes to GDPR regulations, however, there is a concern that blockchain aims for decentralization, which may confuse how \"controllership is defined\" and that it \"hampers the allocation of responsibility and accountability\" [11]. Therefore, it appears that the EU considers blockchain a threat to individuals' data ownership rights and duties [11]. The GDPR's second assumption is that \"data can be modified or erased where necessary to comply with legal requirements, such as Articles 16 and 17 GDPR\" [11; 49]. The contradiction arises in this scenario because blockchain does not allow any data updates, in order to maintain data integrity and trust [25]. The fundamental conflicts that arise when assessing blockchain compliance with GDPR cause a number of problems, one of which is whether or not data on the public blockchain count as sensitive personal data [11]. If the data are considered personal data, GDPR law must be respected. Another argument is whether the data can be properly anonymized to comply with GDPR legislation [11].  
Besides EU data protection legislation, the United States has several data protection laws, including the California Consumer Privacy Act (CCPA) [11; 50]. [PERSON] and [PERSON] [41] outlined the complications that exist when ensuring the conforming of blockchain with the CCPA. As with the GDPR issues, the distributed ledger and data immutability may conflict with the CCPA's obligations [50]. Therefore, it is difficult to identify and maintain responsible controllers in the blockchain [50]. Educational institutions and suppliers thus confront numerous issues in ensuring that their solutions comply with data protection legislation, such as that in the GDPR and the CCPA. However, educational institutions can improve their chances of implementing blockchain systems that comply with data privacy laws. They can, for example, limit or even eliminate the step of saving personal data on the blockchain, try to assess if blockchain technology is truly required to meet a specific business or social purpose, or adopt permissioned blockchains with more stringent usage regulations [11; 50]. In addition, to preserve data integrity, one option is to avoid saving sensitive personal data on the blockchain and instead store simply a hash of the data. For example, [PERSON] [57] reduces the risk of data theft and storage by suggesting the implementation of distributed file storage to encrypt data and enable decryption only through the platform, while using standard key management solutions (KMSes) significantly lowers the risk of data theft.  
Due to the transparency of public blockchains, all transactions are available to everyone. As a result, higher-education institutions may need to establish more stringent privacy protections, such as deploying private or permissioned blockchains or protocols, such as the zero-knowledge proof [11], with rigorous usage constraints to control data access. Therefore, we should underline that the deployment of blockchain technology in education requires the solving of different legal difficulties [11].