As the Ethereum ecosystem and its core principles evolve to address data privacy concerns, a new proposal recommends a modular compliance strategy as a path to reconcile public blockchains with the European Union’s General Data Protection Regulation (GDPR).

On Monday, a proposal drafted by Ethereum community member Eugenio Reggianini suggested the use of modular architecture for effective data management and privacy.

“By pushing personal data to the edges (wallets and DApps), using offchain storage with metadata-erasure, and splitting roles cryptographically, we can focus GDPR controller duties on a small set of entities, while the wider network becomes mere processors or falls out of scope,” Reggianini said.

Ethereum’s transition to a modular architecture could enable the integration of various privacy-enhancing technologies (PETs), which, according to Reggianini, can achieve GDPR compliance in permissionless blockchain environments.

Technical Roadmap: PETs to the Rescue

The proposal outlines several technologies already being integrated or proposed for Ethereum that help reduce personal data exposure:

• Proto-danksharding (EIP-4844): Limits transaction blob lifespans to around 18 days, enforcing storage minimization.
• Zero-Knowledge Succinct Non-Interactive Argument of Knowledge (zk-SNARKs): Enables validators to confirm transaction validity via cryptographic proofs without revealing payload data, reducing onchain visibility.
• Other PETs: Fully Homomorphic Encryption (FHE), Trusted Execution Environments (TEEs), multiparty computation (MPC), Proposer-Builder Separation (PBS) and Peer Data Availability Sampling (PeerDAS).

Ethereum’s Modular Compliance Strategy

The proposal breaks down GDPR implications across the Ethereum network’s three core layers:

Execution Layer: Operates primarily as processors relaying encrypted or blinded data.

Consensus Layer: Focuses on validating cryptographic commitments and zero-knowledge proofs — not transaction payloads.

Data Availability Layer: Under PeerDAS, stores anonymous data shards for limited durations, aligning with GDPR’s data minimization principle.

By focusing data controllership on the application layer and leveraging PETs, Reggianini contends, Ethereum can safeguard user privacy while preserving its decentralized nature.

The approach’s viability hinges on broad community adoption, developer engagement, and alignment with EU regulatory bodies.