# Erasure against an append-only ledger

> Erasure against an append-only ledger: The one collision with no clean answer yet. Region: Global.

Part of the Soda Labs Privacy Hub regulation map, which reads the instruments
themselves rather than summarising the summaries: https://www.sodalabs.xyz/privacy-hub/regulation

## Key facts

- Entry type: Where privacy tech meets the rulebook
- Region: Global
- Subject: The one collision with no clean answer yet
- Tags: GDPR Article 17, immutability, commitments, key destruction, unresolved
- Canonical page: https://www.sodalabs.xyz/privacy-hub/regulation/why-erasure

## What it actually says

This is the collision that does not dissolve on closer reading. European regulators treat a public key as personal data wherever it can identify someone, and are explicit that encryption does not take data outside the rules, nor does hashing. Against that sits an append-only ledger. The EDPB's answer is architectural rather than doctrinal: keep personal data off chain, and design so that on-chain data can be rendered effectively anonymous when erasure is requested. It concedes this is technically demanding while insisting technical impossibility is no defence. Destroying a decryption key is treated as making data unintelligible rather than erased. Commitments fare better, since deleting the original and its witness leaves something genuinely useless behind. No supervisor or court has yet tested either in a contested case.

## The instruments that matter

- **EDPB Guidelines 02/2025, §26**: public keys are personal data where they can identify individuals by means reasonably likely to be used
- **§§51-52**: encrypted personal data is still personal data, and a hash will also be considered personal data
- **§50 and §103**: deletion may be technically impracticable, but technical impossibility cannot be invoked to justify non-compliance
- **§53**: cryptographic commitments treated more favourably, since once the original data and its witness are deleted, the commitment persisting on chain is useless

## Sources

- [EDPB Guidelines 02/2025 (final, 7 July 2026)](https://www.edpb.europa.eu/system/files/2026-07/edpb_guidelines_202502_blockchain_v2_en.pdf)

## Related entries

- [Anonymity is not the same thing as confidentiality](https://www.sodalabs.xyz/privacy-hub/regulation/why-programmable-confidentiality): Why two privacy designs get treated differently
- [Central banks are building confidentiality themselves](https://www.sodalabs.xyz/privacy-hub/regulation/why-central-banks-build-privacy): What the people writing the rules do when they design money
- [Proving where funds did not come from](https://www.sodalabs.xyz/privacy-hub/regulation/why-privacy-pools): Association sets, and the Tornado Cash aftermath
- [Sanctions screening on a confidential ledger](https://www.sodalabs.xyz/privacy-hub/regulation/why-sanctions-screening): The genuinely open problem
- [Selective disclosure as a compliance primitive](https://www.sodalabs.xyz/privacy-hub/regulation/why-viewing-keys): Bilateral disclosure versus publishing to everyone
- [The travel rule binds institutions, not ledgers](https://www.sodalabs.xyz/privacy-hub/regulation/why-travel-rule): The rule everyone assumes ends on-chain confidentiality