The Design and Implementation of a Personal Data Platform Based on a Blockchain Smart Contract

Abstract

The starting point of all problems related to the current personal data ecosystem begins with providing personal data to companies as raw data. Although individuals own personal data, there is a risk of leakage and an administrative burden to store the data with consent upon collection. Furthermore, the data must be destroyed per legal requirements because a company that collects, manages, and stores personal data does not have ownership by its nature. In this thesis, a new personal data platform to address these problems is proposed and reviewed for feasibility. The personal data platform presented in this thesis is based on a shift in the idea that individuals store personal data, not companies. Moreover, companies can use personal data only when necessary. Personal data is stored on the individual’s mobile device to achieve the platform’s design purpose. The data is used by granting permission to use data rather than transmitting the raw data itself. The platform can be implemented by requiring that companies request the use of data and that individuals control the use of data directly via the approval of the access right in the form of a ticket. In this process, the data usage protocol is based on the principle of least privilege. It consists of three steps: local use in the device, de-identified data usage such as local differential privacy (LDP), and data use history tracking. With the implemented personal data platform, individuals can own their personal data and receive compensation for its use. Moreover, companies can confirm the technical feasibility of a personal data ecosystem that proactively uses personal data in business without a compliance risk.