CJEU on identifiability

Confidentiality is workable so long as the regulated firm can identify parties and disclose on demand.

What CJEU on identifiability actually says

Whether a blockchain address is personal data is not a settled question, and the two European institutions answering it are drifting apart. The Court's line is contextual. Breyer held in 2016 that data are personal to a party who has means reasonably likely to be used to identify the person, and in September 2025 the Court sharpened this considerably: the same pseudonymised dataset can be personal data for the controller holding the re-identification key and non-personal for a recipient with no realistic path to re-identify. That is the strongest available argument that an address is not personal data to everyone who can see it. The EDPB's blockchain guidelines take a markedly broader view. This gap is the most consequential open question for anyone building on-chain in Europe.

What this means for confidential transactions

Bubble is built for exactly this shape of obligation: amounts and balances live on chain as ciphertexts, computation happens without decryption, and the only disclosure path is an on-chain access list through which an authorized party - an auditor, a supervisor, a counterparty - can request scoped decryption. That is confidentiality from the public, not from the regulator.