# NFTs for the Issuance and Validation of Academic Information That Complies with the GDPR
## 4 Discussion
The primary advantage of adding this information is that it increases the degree of decentralization of the solution. Even if the institution issuing the academic information disappears and the tokenURI is empty, it is possible to verify that the data sent by the data holder, along with the salt and key, match the information stored in the NFT available on the blockchain. However, this comes at the expense of the data holder sharing more information (i.e., personal data for verification, salt, and an encryption key). 2. If the recommendations provided by data protection authorities are not strictly followed, personal data could not only be exposed but also permanently stored on the blockchain. 3. Once authorization is granted to a third party to access the data, and the actual data, salt, and encryption key are shared, even if permission is later revoked, if this third party does not destroy or leak the information, data privacy may be compromised. As mentioned, the hash summary with encrypted salt is stored on the blockchain and accessible to anyone if a public blockchain is used. For these reasons and because, in general, the model does not significantly improve with this addition or better align with the requirements of \"privacy, security, and legal by design,\" a slightly more centralized yet more secure and private approach was chosen, always ensuring that the transactions for issuing NFTs are generated by accredited institutions. It should also be noted that if the tokenURI is allowed to be updated with the NFT, in case there is a problem with the Internet domain used (server.com in the example), it could be updated so that the NFT continues to function as it should. Another interesting point for discussion is the issue of burn permissions and who can destroy the NFT and who cannot. In the MVP provided, only the institution issuing the NFT was allowed to destroy it, but provisions could be made for the data holder to have this option as well. From the perspective of data privacy, this poses no significant impact. However, to prevent the unauthorized or even malicious issuance of NFTs to accounts by an organization and render these actions futile, allowing the data holder the burn option would be desirable. Nevertheless, in the case of official academic certifications, for instance, and always within the legal framework of each country, it might not be feasible for a certificate holder to destroy it. This should be reflected when programming the smart contracts that support NFTs. Another aspect worth analyzing is whether the term NFT is truly fitting for this information. By nullifying the transfer function, as explained, to prevent the holder from transferring ownership of the academic information and leaving the burn function as a choice for the institution, it could be argued that instead of an NFT with value in the market, it is actually a Soulbound token or SBT [85], a unique and non-transferable type of NFT that represents an individual or entity on the blockchain. In this document, the term NFT is used, but, due to its characteristics, it could be accurately classified as an SBT.