# NFTs for the Issuance and Validation of Academic Information That Complies with the GDPR
## 3 Proposed Model  
As discussed above, the issuance of academic certificates within the educational sector is continually evolving to guarantee authenticity and information readiness. Additionally, the present-day job market requires people to keep track of educational achievements not originating from an academic institution, such as informally acquired skill sets or professional experience. The innovative model proposed is based on issuing NFTs supported by blockchain technology to represent academic information uniquely and dynamically, ensuring compatibility with the GDPR requirements at the same time. The core concept behind this model is a reformulation of the model proposed in [32] to use NFTs. Note that the technology for interconnecting different blockchains to create a universal platform based on this framework is still under research and in its infancy stage [55; 56; 57; 58; 59], the challenge being to achieve the model's privacy and scalability objectives at a global scale. Thus, the proposal in this paper is a revision of our seminal model so that it can be realized with presently available technology (cf. Figure 1). In this proposal, academic institutions, or anyone wishing to issue an accreditation of some specific educational achievement to an individual with a known blockchain address (i.e., a wallet address), would issue an NFT to that individual, signed with the private key of the issuer, thus emitting academic information as an NFT. However, generating a record containing personal information (e.g., names, surnames, etc.) and storing it directly in a blockchain or decentralized storage (e.g., IPFS, Swarm, or an equivalent storage model), does not comply with the GDPR [5]. Even if the NFTs were configured as dynamic, allowing the issuer to modify their attributes (e.g., to comply with the data subject's right to modify data), previous blockchain transactions would retain the original data in an immutable way. Additionally, erasing this information is impossible, breaching the right to be forgotten. The GDPR directly prohibits storing data in a permanent storage medium like a blockchain, even if encrypted. For instance,using a public blockchain like Ethereum and encrypting data with a robust algorithm would permanently store the encrypted information in the blockchain. This poses a risk, as advancements in computing power or algorithm vulnerabilities could expose this personal information in the future. Some projects like Blockcerts [3] store a hash resume of the academic information. However, the GDPR considers the hashed summary an invalid pseudonymization technique [5]. For these reasons, in this model, a distinction is made between information considered public and private data. Examples of public information items are the issuer's address, a recognized institution whose authority can be demonstrated, the recipient's address (for enhanced privacy, individuals can be allowed to generate a new address for each received academic piece of information), the institution name, issuance date, certificate validity, etc. On the other hand, attributes such as names, surnames, grades, and study completion dates, or in the case of professional experience, employers' remarks, photographs, or contact details, are considered private personal information. Note that this model is open-ended and not confined to a fixed set of fields, allowing for its adaptation to various content types. Table 1 summarizes some of the main initiatives related to blockchain and education extracted from the academic literature, which were also compared with the initial proposed model [32] from the perspective of where data are stored and compliance with the GDPR. The table also includes those that use NFTs for academic information. Figure 1: Proposed model (overview). \begin{table}
\begin{tabular}{c c c c c c c c c c c} \hline \hline
**Initiative** & **Scalability** & **Storage** & **Regenerate** & **Verification** & **Right to** & **Data** & **GrantRemove** & **Data** & **Data Access** \\  & **No.