سجلات القرارات · ADR-008
ADR-008: No personal data on-chain
The batch record never holds coordinates or natural-person identifiers; origin is a reference to evidence, and precise geodata lives off-chain behind access control.
- معرّف المستند
- ADR-008
- التاريخ
- 2026-09-21
- المصدر
- docs/adr/ADR-008.md
| Field | Value |
|---|---|
| ID | ADR-008 |
| Subject area | Privacy |
| Status | Accepted |
| Date | 2026-09-21 |
| Owners | A-REX Contributors |
| Related requirements | NFR-04, C-03 (SDD §3) |
| Supersedes / superseded by | — |
Context
The earlier design stored plot coordinates with six-decimal precision, immutably. For a smallholding, a plot polygon identifies the producer. The EDPB Guidelines 02/2025 on blockchain (version 2.0, July 2026) treat on-chain data as personal data in principle, state that hashing does not anonymise, and advise against storing personal data on-chain. Latin American laws (LGPD, Ley 25.326, Ley 19.628) follow similar principles. The EUDR still requires geolocation in the due-diligence statement, which is filed with the authority, not published on a ledger.
Issue
How can a lot prove its origin without publishing personal data on an immutable ledger?
Assumptions
- Plot geolocation of smallholders is personal data.
- Erasure and rectification rights cannot be honoured on an immutable ledger.
Constraints
- GDPR, EDPB 02/2025 and Latin American data-protection law (C-03).
Alternatives considered
| Alternative | For | Against | Outcome |
|---|---|---|---|
| Coordinates on-chain with consent | Transparent | Consent cannot be withdrawn from an immutable ledger | Rejected |
| Hash of the coordinates on-chain | Looks anonymous | Still personal data per the EDPB; low entropy allows brute force | Rejected |
originRef as a reference to evidence; restricted pointer in metadata | No personal data on-chain; evidence still verifiable | Verification needs access to the restricted store | Accepted |
Decision
IARexBatch.originRef MUST NOT contain raw coordinates or identifiers of natural persons; it holds a reference to origin evidence, such as a hashed EUDR DDS reference or a registry id. The metadata schema separates public data from a restricted pointer whose content is access-controlled off-chain.
Argument
Referencing evidence instead of publishing it satisfies both sides: the regulator and the buyer can verify origin through the reference, and the producer's data never reaches the ledger.
Consequences
Positive
- The token is deployable in the EU and Latin America without a data-protection conflict.
- EUDR verification uses the DDS reference the authority already holds.
Negative
- Public verification of origin needs cooperation from whoever holds the restricted data.
Obligations it creates
- Issuers keep restricted data out of
uri,originRefand event data. - The schema's
restrictedobject documents the access policy.
Implementation and evidence
| What | Where |
|---|---|
| Normative rule | standard/AREX-CORE.md §3.5 |
| Schema | standard/schema/batch-metadata.schema.json (restricted) |
| Whitepaper | Regulatory Compliance chapter |