Second layer data governance for permissioned blockchains: the privacy\n management challenge

Data privacy is a trending topic in the internet era. Given such importance,\nmany challenges emerged in order to collect, manage, process, and publish data.\nIn this sense, personal data have got attention, and many regulations emerged,\nsuch as GDPR in the European Union and LGPD in Brazil. This regulation model\naims to protect users' data from misusage and leakage and allow users to\nrequest an explanation from companies when needed. In pandemic situations, such\nas the COVID-19 and Ebola outbreak, the action related to sharing health data\nbetween different organizations is/ was crucial to develop a significant\nmovement to avoid the massive infection and decrease the number of deaths.\nHowever, the data subject, i.e., the users, should have the right to request\nthe purpose of data use, anonymization, and data deletion. In this sense,\npermissioned blockchain technology emerges to empower users to get their rights\nproviding data ownership, transparency, and security through an immutable,\nunified, and distributed database ruled by smart contracts. The governance\nmodel discussed in blockchain applications is usually regarding the first layer\ngovernance, i.e., public and permissioned models. However, this discussion is\ntoo superficial, and they do not cover compliance with the data regulations.\nTherefore, in order to organize the relationship between data owners and the\nstakeholders, i.e., companies and governmental entities, we developed a second\nlayer data governance model for permissioned blockchains based on the\nGovernance Analytical Framework principles applied in pandemic situations\npreserving the users' privacy and their duties. From the law perspective, we\nbased our model on the UE GDPR in regard to data privacy concerns.\n