# A Data Sharing Scheme for GDPR-Compliance Based on Consortium Blockchain
## 5 Analysis and Discussion  
### Comparative Analysis  
We make a comparison between our scheme and some other related solutions, the result in Table 1 shows that our scheme is more comprehensive:  
Confidentiality: The security of the data on the blockchain in our solution is mainly based on asymmetric encryption. As long as the system parameter is large enough, the security of blockchain can be guaranteed. The asymmetric encryption algorithm is statistically secure in the proposed scheme. If the corrupt node or the attacker does not have the decryption key, the data submitted to the blockchain cannot be decrypted. The study [17] proposed a GDPR-compliant framework ADVoCATE, its design covers most of the rights in the GDPR, but the framework does not introduce customized encryption measures for shared data, so data confidentiality cannot be guaranteed. Regulatory-Traceability: Compared with traditional solutions, all data recorded in blockchain are traceable and cannot be changed once written. Thus, GDPR compliance investigations can be conducted. Non-compliance activities will cause regulators to conduct formal investigations and audits of service providers. In the study [15], the authors have not introduced regulatory authorities, their solution is unable to supervise service nodes, the timely regulatory traceability of the blockchain cannot be guaranteed. ADVoCATE in the study [17] is mainly oriented to IoT, which introduces regulatory authorities in the entity to ensure regulatory traceability. \begin{table}
\begin{tabular}{l c c c c c c} \hline \hline
**ApproachesFeatures** & **Confidentiality** & **Regulatory-Traceability** & **Privacy-Preservation** & **Availability** & **Integrity** & **Mutual Authentication** \\ \hline Ours & ✓ & ✓ & ✓ & ✓ & ✓ & ✓ \\ [PERSON] et al. [15] & ✓ & ✕ & ✕ & ✓ & ✕ & ✕ \\ [PERSON] et al. [17] & ✕ & ✓ & ✕ & ✓ & ✕ & ✕ \\ [PERSON] et al. [19] & ✕ & ✓ & ✓ & ✓ & ✓ & ✕ \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Qualitative comparisons of the proposed scheme with the existing works (Support ✓, Non-Support ✕). Privacy-Preservation: Blockchain will assign a unique pseudonym to every participating entity, and thus the pseudo-identity will be used in the subsequent process without revealing the real identity. In the process of data sharing, any entity participating in the interaction with the smart contract will not disclose data privacy. Smart contracts can only receive the ZK-proof rather than the privacy data of the data subject. In addition, the service provider will only publish some keywords, not the entire requirement, which guarantees data privacy protection. In the study [15], the authors only adopt digital signatures to prove the node submitting the block. In addition, their data does not adopt ZK-proofs when interacting with smart contracts, which may be the source of privacy leaks. Although ADVoCATE [17] uses an intelligent policy analysis mechanism to support the so-called user privacy policy, it does not take measures other than encryption for privacy protection during user data interaction. The GDPR-compliant blockchain framework for healthcare in the study [19] achieves partial privacy-preservation by enabling patients to anonymize their names and identities. Availability: In the proposed scheme, only authorized entities can decrypt the specific data of the data subject. Data subjects can generate proof by private data which follows the data controller's requirement. Proof can be sent to the smart contract to determine if the user's data meets the service provider's established requirements or not, without revealing the user's privacy. This feature ensures data availability. The availability of data is the prerequisite for all other features, all the schemes proposed in the comparison work have achieved availability in their designs. Integrity: After the successful verification, the transaction between the user and the service provider will be published on the blockchain.