Are public keys personal data?

Michèle Finck in her excellent paper on Blockchains and Data Protection in the EU mentions that public keys are considered personal data. In this blogpost we will have a closer look at what are public keys, why can they be considered personal data, and what implications this has.

What are public keys?

To explain what public keys are, it is useful to start with a quite basic explanation of what symmetric and asymmetric encryption is. When encrypting something, usually a key is used. In case of symmetric encryption, the same key is used to encrypt and to decrypt the information. For example, in case Alice wants to send a secret message to Bob, she uses her key x. After receiving the encrypted message, Bob uses the same key x to decrypt the message. Of course, Bob would have needed to receive the key x beforehand in such a safe way that it is ensured that nobody else could receive the key, since otherwise the whole aim of the encryption would have been useless (similar to companies who encrypt their data but then store the encryption key in the same database).

To address the key sharing problem, asymmetric encryption is used. Asymmetric encryption is based upon specific mathematical problems, e.g. when multiplying two large prime numbers it is very difficult to identify the originally multiplied prime numbers if you just have the result. This means that two different, but mathematically linked keys exist, one private and one public. The public key can be published since it is not possible to derive from the public key the private key, but at the same time anything encrypted with the public key can only be decrypted with the private key. The private key should be kept secret, and anything encrypted with the private key can be decrypted with the public key. Therefore Alice can send Bob a message encrypted with Bob’s public key, and only Bob can decrypt it with his private key, and can send back a message encrypted with Alice’s public key. However, the technology can also be used the other way around, which is how digital signatures work. If Alice wants to prove that something she sends is indeed from her, she can encrypt it (or usually a hash of it) with her private key, and everybody can then check by decrypting with the corresponding public key, that it has indeed been sent by her. In order to ensure that the public key is indeed Alice’s public key and not from somebody else, normally certificates are used, whereby often a trusted third party states that this public key indeed belongs to Alice.

What is personal data?

The scope of ‘personal data’ in the GDPR is rather wide and covers “any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person” (art. 4 (1) GDPR).

The Article 29 Working Party considers a natural person as ‘identified’ when “he or she is “distinguished” from all other members of the group” and ‘identifiable’ if it is possible to do so. A decisive factor in considering a person identifiable is the notion of ‘means likely reasonably to be used’. The CJEU decided in the Breyer decision on a question regarding the means likely to be used, considered that the possibility to combine a dynamic IP address with the additional data held by the internet service provider could constitute means likely reasonably to be used to identify the data subject. However, in that case it was possible via legal channels to obtain the information, and in case the identification would require a disproportionate amount of time, money or workforce, the data might not be considered identifiable.

Are public keys personal data?

Asymmetric encryption, and with it public keys, is a technology which is used in many ways in the online world, in order to encrypt, exchange keys or to digitally sign something, usually to secure it (e.g. SSL (https) protocol;  code signing, etc.).

In the end, the answer is a lawyerly ‘it depends’. If the public key can for example only be connected to a company, it will generally not be considered personal data (except if within the company a system exists where specific public/private keys are allocated to specific people). However, if the public key, with additional information, e.g. in a certificate, can be connected to a natural person, it will be considered personal data. In case of bitcoin, research has shown that public keys can often via additional information be connected to natural persons. Another question is that since the public keys in blockchains will be available as long as the blockchain exists, even if now the means are not available or likely to be used, in future they might be.

Special thanks to Iraklis Symeonidis for his feedback.