2026-04-10 –, Glatt (Y22-F-68/70)
Public blockchains have been described as incompatible with EU privacy law because on-chain data is often perceived as personal data. However, under EU privacy laws, whether data is personal depends on context, on who receives it, and on whether a person can realistically be identified.
The talk presents a practical way to think about “identifiability” during system design. Instead of legal abstractions, it uses concepts builders already work with: what is visible, who has access, what additional data would be needed, and how feasible identification actually is.
By examining common data flows on public permissionless blockchains, the talk shows how the same data can have different privacy implications for different actors. The aim is not to label systems as compliant or non-compliant, but to give teams tools to assess privacy exposure while planning and building.
Discussions about privacy and public blockchains often revolve around whether on-chain data should be treated as personal data by default. In practice, EU privacy law approaches this question in a more contextual way: whether data is personal depends on how it is used, who has access to it, and whether it can realistically be linked to a person. Public permissionless blockchains make this especially visible because they (often) separate the existence of data from the ability to connect it to real-world identities.
This talk examines how identifiability emerges from system design and operational roles, rather than from the protocol alone. It examines how data moves through a public blockchain environment and how different actors interact with it, including application developers, infrastructure providers, analytics services, and crypto-asset service providers (CASPs) operating under EU regulatory frameworks. The same blockchain data can therefore carry very different privacy implications depending on the role, capabilities, and legal position of the actor processing it.
Ideal audience: Builders, protocol designers, founders, product leads, and anyone working on public permissionless blockchains who want a clearer, more grounded way to think about privacy without turning it into a purely legal problem.
No legal background required.
Vyara Savova is Senior Policy Lead at the European Ethereum Institute (EEI), formerly EUCI, a Brussels-based non-profit that promotes Ethereum as a core layer of public infrastructure for institutions across the EU and UK. A lawyer qualified in Bulgaria with an LL.M. in Human Rights from SOAS, University of London, she is also a PhD candidate researching privacy on-chain and the use of smart contracts as a legal and technological solution. Vyara has extensive experience in data protection, crypto regulation, and digital policy, and regularly contributes to European debates at the intersection of privacy, blockchain, and law.