Local, centralised or decentralised Personal Data storage
By: Jules Goddard
Tags: Smart Contracts, Blockchain, Data Science, Decentralization, Programming

Personal Data Storage Location

This article discusses the ideal location to store personal data.

Photo by Florencia Viadana on Unsplash

Discussion

Where is the ideal location to store personal data?

In this article, we discuss the person that owns the personal data and the organisation that uses the personal data. Other models are available.

Each organisation interacts with multiple people:

Each organisation interacts with multiple people

Additionally, each person interacts with multiple organisations:

Each person interacts with multiple organisations

For the remainder of this article, we shall only consider the point of view of one person.

Possible Personal Data Storage Locations

We can deduce that the possible storage locations of personal data are:

Possible Storage Locations of Personal Data

We will discuss each of these in turn below.

1) Personal Data Stored with the Person

This is only possible if the person has a powerful, interconnected computing device, such as a modern mobile phone, tablet or laptop (a local device) connected to the internet:

Each person stores their own personal data on their local device

Not everyone will have access to, or will be able to use, this technology.

Examples of locally stored personal data are Cookies and LocalStorage, which contain data unique to the person which the organisations want. However, cookies are only applicable when the person visits the organisations’ websites, and they are under the control of the organisation. Typically, a person is unable to view or edit cookies, although they can usually delete them. LocalStorage could be used by a local front-end app and an organisational backend.

There may be some issues with storing all personal data locally from the organisation’s point of view. Access to some personal data may be legitimately needed 365 and 24/7 and irrespective of geolocation availability. The device will also need the bandwidth to deal with personal data requests from multiple organisations.

Not surprisingly, to our knowledge no organisations offer this. We are sure that few organisations would even countenance it.

2) Personal Data Stored with the Organisation

This is usually what is happening throughout the world in 2020.

Everyones’ personal data (and much more besides) is stored by the organisation:

The organisation stores personal data

This is centralisation of personal data. It is convenient for the organisation because they store the personal data as they see fit, and they are in control of the personal data, and do whatever they want with it (subject to regulations, of course).

Because each person typically uses multiple organisations, there are multiple copies of everyones’ personal data stored across multiple organisations:

Each organisation stores its own copy of the personal data

This means that processes are required to maintain personal data amongst multiple organisations. Generally, those processes will be different for each organisation.

Nation states use regulations (such as GDPR) to enforce privacy and security of personal data in every organisation.

At Datona Labs we have identified several issues with personal data centralisation (see our website and whitepaper), amongst them:

centralised data is a tempting gold mine for data thieves

centralised data carries a risk of becoming lost, stolen, old or sold

centralised data carries a risk of affecting our autonomy and privacy

We call this behaviour Personal Data Abuse and our mission is to provide products and services to reduce it, as described below.

3) Personal Data Stored Somewhere Else

This is introducing a (notional) third-party to the interaction between the person and the organisations.

A third party stores the personal data for the organisations

It is the advent of modern technology (mobile devices, connectivity, cryptography and blockchain) that has enabled this ground-breaking step.

Why would organisations even consider this option?

The advantage of this option is that regulation (such as GDPR) compliant personal data can be readily available 365 and 24/7 to the organisation.

What’s more, the data can be shared between organisations, meaning that when a person updates their personal data , which they can do anytime, even when the organisation is closed, all affected organisations will have access to the updated data. This is desirable to meet the regulations (such as the GDPR Accuracy principle and other personal rights).

Although this option is already very good at providing high regulation (such as GDPR) compliance, we can do even better.

Firstly, let’s encrypt the personal data and store it in a data vault to comply with the regulations (such as the GDPR Integrity and Confidentiality principle), and probably most organisations’ privacy policies as well:

The encrypted personal data for the organisations is stored in a data vault

Secondly, let’s control access to the data using blockchain smart contracts agreed between the person and the organisations, to comply with the regulations (such as GDPR Storage and Purpose Limitation principles):

The encrypted personal data is stored in a data vault and controlled by smart contracts

This will also enable the organisation to easily comply with a person’s privacy rights (such as rectification and erasure in GDPR).

What’s more, the organisation does not need to be reliant upon a third-party supplier in order to access the personal data, because the data access method is stored on a public blockchain and is thus decentralised.

Now we have a very good balance:

The person and organisation agree a binding contract determining what access is available for which personal data and when The smart contract can automatically terminate personal data access when the service expires without any action required by the organisation or the person The person can update their personal data 365 and 24/7 The organisation is not reliant upon a third-party, everything is decentralised The organisation achieves high regulation (such as GDPR) compliance The person achieves good control of personal data

Conclusion

It is far from ideal to store personal data in a centralised manner. There is a risk of personal data abuse which is evidenced by continuous reports in the media.

Additionally, personal data regulation (such as GDPR) compliancy is difficult and expensive for organisations. Ultimately, these are costs that will be borne by the people using those organisations.

Storing personal data in a data vault controlled by a smart contract provides the organisation with high personal data regulation (such as GDPR) compliance and the person with good control of their personal data.

We recommend this technique, which we at Datona Labs call Smart Data Access. Please see our website and whitepaper for more details.

Bio

Jules Goddard is a founder of Datona Labs, who provide smart contracts to protect your digital information from abuse.

website — twitter — discord — GitHub

Also, Read