Can a Private Blockchain Comply with “Right to Be Forgotten” Rules If It Is Immutable?
Direct compliance is challenging because the "Right to Be Forgotten" (RTBF) requires the deletion of personal data, which contradicts blockchain immutability. Compliance is achieved by storing personal identifying information (PII) off-chain and only storing an encrypted hash or a non-identifying reference on the blockchain.
When an RTBF request is made, the PII is deleted from the off-chain storage, rendering the on-chain hash meaningless without the corresponding data.