Enregistrements de décision · ADR-008

ADR-008: No personal data on-chain

The batch record never holds coordinates or natural-person identifiers; origin is a reference to evidence, and precise geodata lives off-chain behind access control.

Accepted

Identifiant du document: ADR-008
Date: 2026-09-21
Source: docs/adr/ADR-008.md

Disponible uniquement en anglais

Cette page est en anglais. Les chapitres du livre blanc et les diagrammes sont traduits. Le standard normatif reste dans le dépôt ; utilisez Demander un accès anticipé pour ce texte. Les guides de conception du système et les enregistrements de décision restent en anglais.

Field	Value
ID	ADR-008
Subject area	Privacy
Status	Accepted
Date	2026-09-21
Owners	A-REX Contributors
Related requirements	NFR-04, C-03 (SDD §3)
Supersedes / superseded by	—

Context

The earlier design stored plot coordinates with six-decimal precision, immutably. For a smallholding, a plot polygon identifies the producer. The EDPB Guidelines 02/2025 on blockchain (version 2.0, July 2026) treat on-chain data as personal data in principle, state that hashing does not anonymise, and advise against storing personal data on-chain. Latin American laws (LGPD, Ley 25.326, Ley 19.628) follow similar principles. The EUDR still requires geolocation in the due-diligence statement, which is filed with the authority, not published on a ledger.

Issue

How can a lot prove its origin without publishing personal data on an immutable ledger?

Assumptions

Plot geolocation of smallholders is personal data.
Erasure and rectification rights cannot be honoured on an immutable ledger.

Constraints

GDPR, EDPB 02/2025 and Latin American data-protection law (C-03).

Alternatives considered

Alternative	For	Against	Outcome
Coordinates on-chain with consent	Transparent	Consent cannot be withdrawn from an immutable ledger	Rejected
Hash of the coordinates on-chain	Looks anonymous	Still personal data per the EDPB; low entropy allows brute force	Rejected
`originRef` as a reference to evidence; restricted pointer in metadata	No personal data on-chain; evidence still verifiable	Verification needs access to the restricted store	Accepted

Decision

IARexBatch.originRef MUST NOT contain raw coordinates or identifiers of natural persons; it holds a reference to origin evidence, such as a hashed EUDR DDS reference or a registry id. The metadata schema separates public data from a restricted pointer whose content is access-controlled off-chain.

Argument

Referencing evidence instead of publishing it satisfies both sides: the regulator and the buyer can verify origin through the reference, and the producer's data never reaches the ledger.

Consequences

Positive

The token is deployable in the EU and Latin America without a data-protection conflict.
EUDR verification uses the DDS reference the authority already holds.

Negative

Public verification of origin needs cooperation from whoever holds the restricted data.

Obligations it creates

Issuers keep restricted data out of uri, originRef and event data.
The schema's restricted object documents the access policy.

Implementation and evidence

What	Where
Normative rule	`standard/AREX-CORE.md` §3.5
Schema	`standard/schema/batch-metadata.schema.json` (`restricted`)
Whitepaper	Regulatory Compliance chapter

ADR-006: Open codes instead of closed enumerations
ADR-009: Attestations implemented in a companion contract