# NFTs for the Issuance and Validation of Academic Information That Complies with the GDPR
## 4 Discussion
\begin{table}
\begin{tabular}{c c c} \hline \hline
**Requirement** & **Fulfilled?** & **Explanation** \\ \hline Principle of lawfulness, fairness, and transparency. & & \\ Personal data shall be processed lawfully, fairly, and & Yes & Explicit consent from the data subject is obtained, as \\ transparently in relation to the data subject. (GDPR, & requested by the institution and third parties seeking \\ Art. 5.1.a) & & \\ \hline The principle of purpose limitation (GDPR, art. 5.1.b) & Yes & The issuing institution and authorized third parties \\  & & must only use them for specific purposes. \\ \hline Principle of data minimization (GDPR, art. 5.1.c) & Yes & The model is entirely flexible regarding the set of fields \\ Principle of data minimization (GDPR, art. 5.1.c) & Yes & \begin{tabular}{c} used, ensuring that they are only the minimum \\ necessary for the intended purpose. Moreover, the data \\ subject can select which fields third parties may access \\ when interacting with the NFT. \\ \end{tabular} \\ \hline The principle of accuracy (GDPR, art. 5.1.d) & Yes & \begin{tabular}{c} The personal data are accurate, and in case of any \\ inaccuracy, the issuing institution can easily remove or \\ rectify them, as they are stored within their databases. \\ \end{tabular} \\ \hline The principle of storage limitation (GDPR, art. 5.1.e) & Yes & \begin{tabular}{c} The institution issuing personal academic information \\ has the flexibility to delete it, when necessary, thanks to \\ the proposed model. \\ \end{tabular} \\ \hline The principle of integrity and confidentiality (RGPD, & Yes & \begin{tabular}{c} The issuing institution is responsible for safeguarding \\ the data’s integrity and confidentiality. The proposed \\ model based on NFTs does not compromise \\ this requirement. \\ \end{tabular} \\ \hline Accountability principle (GDPR, art. 5.2) & Yes & \begin{tabular}{c} Access logs are maintained by the institution that holds \\ the data, which can be reviewed by the data subject, as \\ outlined in the model. \\ \end{tabular} \\ \hline Data modification (GDPR, Art. 16) & Yes & \begin{tabular}{c} The model allows for easy data modification, ensuring \\ that third parties accessing the information always see \\ the updated, accurate, complete, and correct version. \\ \end{tabular} \\ \hline The user has the capacity to exercise the right to be & Yes & \begin{tabular}{c} If the academic information needs to be deleted, it is a \\ matter of removing it from the issuing entity’s internal \\ centralized databases, ensuring no personal data \\ remains on the blockchain. \\ \end{tabular} \\ \hline Data portability (GDPR, art. 20) & Yes & \begin{tabular}{c} The model enables data to be moved from one place to \\ another by either requesting it from the institution or \\ downloading it in a JavaScript object notation (JSON) \\ format from the NFT. \\ \end{tabular} \\ \hline The right not to be subject to a decision based solely & Yes & \
\begin{tabular}{c} Even if automated tools are employed to detect the \\ academic information issued under the model, they \\ cannot access personal data without \\ proper authorization. \\ \end{tabular} \\ \hline Control of data transfer to countries outside the & Yes &
\begin{tabular}{c} The model does not prevent this control, which remains \\ in the hands of the entity responsible for data processing, \\ as no personal data are stored in the blockchain. \\ \end{tabular} \\ \hline \hline \end{tabular}
\end{table} 
Table 2: Compliance with requirements. The model was designed to \"implement appropriate technical and organizational measures at the time of determining the means for processing as well as at the time of the actual processing\" (GDPR, Article 25, paragraph 1). Public, private, or consortium blockchain? The proposed solution utilized a public blockchain (i.e., an Ethereum testnet); however, it could also be deployed on a private or consortium blockchain based on Ethereum or Hyperledger technology, to cite just two examples.