CJEU on identifiability

Confidentiality is workable so long as the regulated firm can identify the parties and disclose on demand. Encrypted amounts are not the thing being restricted.

What CJEU on identifiability actually says

Whether a blockchain address is personal data is not a settled question, and the two European institutions answering it are drifting apart. The Court's line is contextual. Breyer held in 2016 that data are personal to a party who has means reasonably likely to be used to identify the person, and in September 2025 the Court sharpened this considerably: the same pseudonymised dataset can be personal data for the controller holding the re-identification key and non-personal for a recipient with no realistic path to re-identify. That is the strongest available argument that an address is not personal data to everyone who can see it. The EDPB's blockchain guidelines take a markedly broader view. This gap is the most consequential open question for anyone building on-chain in Europe.

What this means for confidential transactions

Bubble is built for exactly this shape of obligation: amounts and balances live on chain as ciphertexts, computation happens without decryption, and the only disclosure path is an on-chain access list through which an authorized party - an auditor, a supervisor, a counterparty - can request scoped decryption. That is confidentiality from the public, not from the regulator.