# NFTs for the Issuance and Validation of Academic Information That Complies with the GDPR
## 3 Proposed Model
### Building a Minimum Viable Product  
To demonstrate the feasibility of the proposed model with current technology, an MVP (Minimum Viable Product) was developed using Ethereum and a web server, following the model outlined in Figure 1. In this case, the blockchain is an Ethereum-based blockchain, and the rest of the elements are the same as in that model.  
Firstly, an Ethereum smart contract was developed using Solidity, employing the ERC721 standard [43] and OpenZeppelin's ([[https://www.openzeppelin.com/](https://www.openzeppelin.com/)]([https://www.openzeppelin.com/](https://www.openzeppelin.com/)), accessed on 1 December 2023) secure libraries supporting NFTs. OpenZeppelin is an open-source framework used to build secure smart contracts that provides a complete suite of security products and audit services to build, manage, and verify all aspects of software development and operations for decentralized apps (dApps).  
Certain functions were disabled within the smart contract to prevent the transfer of ownership of the NFT to another account, as this asset is not intended to potentially change ownership. Additionally, the burn function was restricted solely to the issuer of the NFT.  
Upon deploying the smart contract supporting NFTs, an initial token (0) was created and assigned to the holder of the academic information, identified by their Ethereum public address. The tokenURI was configured to refer to a web address of the form [[https://www.server.com/data.php?id=xyz](https://www.server.com/data.php?id=xyz)]([https://www.server.com/data.php?id=xyz](https://www.server.com/data.php?id=xyz)) (accessed on 11 January 2024).  
Whenever these dynamic metadata [81] are requested, a centralized server maintained by the institution E will verify whether the accessing account is authorized. This control mechanism also logs access details, including the date and time.  
The dynamically generated metadata file of the token includes attributes such as the institution's name, the internal database registration number where the information is stored, the modification date and time in the internal database, name, surname, national ID number of the individual, completed course name, credits, final grade, validation status or revocation, course credits, course completion date, and course subjects.  
In this MVP, additional information, such as the internal database record identifier and the date/time of the last modification in the issuer's database, was included for increased transparency. This allows users accessing the information to know if the registration number has changed or if there have been modifications in the database.  
Metadata generation was programmed using a PHP-based script where different metadata are generated based on the input parameter \"id\". Access control is managed via a cookie; individuals granted permission by the data owner and possessing this cookie can access the complete certificate information or parts of it. Otherwise, access is denied. The user type determines whether all attributes or only a portion of them are generated, simulating the behavior seen when data owners grant access to specific parts of their academic information.  
The smart contract was deployed on Ethereum's Gorli testnet (Sepolia is another option) using Remix and Metamask for testing, demonstrating the expected functionality of an MVP to verify the feasibility of this NFT-based model.  
A logging system on the web server records who logs in to access the information and when, allowing the academic information holder to monitor who accesses their data and manage permission grants or revocations.