Summary
Drawing on the German Federal Office for Migration and Refugees (BAMF) case, the paper presents two actionable design principles for GDPR-compliant blockchain solutions in cross-organizational workflow management: do not store personal data on a blockchain, and, where attribution is required, use a highly secure off-chain mapping architecture.
Artifact
A GDPR-compliant blockchain solution for the German asylum procedure, piloted with two authorities (the BAMF and Saxony's central immigration authority, LDS) on a Hyperledger Fabric blockchain. The final architecture has three layers: layer one holds each authority's existing databases and workflow management systems; layer two (the adapter layer) holds blockchain adapters, which submit status-update events to the blockchain, and privacy services, which map each authority's own identifiers to the pseudonymous identifiers used on-chain; layer three is the blockchain itself, storing only pseudonymized events (status, timestamp, authority ID, pseudonymous identifier). Rectification is performed via a rectification transaction submitted to the blockchain; erasure is performed by deleting the identifying mapping in the privacy service, which depersonalizes (without deleting) the on-chain data.
Methodology
Participatory action research: three AR cycles (privacy-sensitive prototype design; detailed GDPR-compliance analysis; design of a GDPR-compliant three-layer architecture) conducted with the German Federal Office for Migration and Refugees (BAMF); derivation of two tentative design principles.