What the EU’s GDPR Means for VASPs and Crypto Transactions
The EU’s Travel Rule (Transfer of Funds Regulation) requires virtual asset service providers (VASPs) to collect and exchange their customers’ delicate personal information when transacting. Conversely, the EU’s General Data Protection Regulation (GDPR) mandates the protection of this data, posing a conundrum to VASPs handling EU citizens’ data or operating within the EU: how to comply with both?
Below, we explain what the GDPR is, along with factors VASPs need to take into account when operating.
What Is the General Data Protection Regulation (GDPR)?
The EU’s GDPR outlines the protection of natural persons regarding the processing of personal data and the free movement of such data, repealing Directive 95/46/EC.
More specifically, it governs how entities, such as VASPs operating within the EU or handling data of EU citizens, should collect, process, store, and transfer personal data. With the GDPR, VASPs are obligated to ensure their data handling processes are lawful and completely secure.
Read more about the EU’s Travel Rule.
How the GDPR Applies to VASPs and Crypto Transactions
Firstly, the EU’s Travel Rule (Transfer of Funds Regulation, TFR) requires VASPs to collect and exchange an originator’s and beneficiary’s personal data when conducting a crypto transaction over a specific threshold. In the case of the EU, that threshold is zero.
The GDPR applies to all EU member states and also to entities outside the EU that process data of EU citizens (Article 3). This means that any organisation, such as VASPs, handling the personal data of EU residents must comply with the GDPR, regardless of its physical location.
Under GDPR Article 6(1)(c), this processing is lawful if necessary for compliance with a legal obligation, such as those imposed by anti–money laundering laws and the EU’s Travel Rule.
To comply with the GDPR and the EU’s Travel Rule, VASPs should consider the following best practices:
1. A Secure and Privacy-first Transfer Protocol Must be Used
Under Articles 5(1)(f) and 32, controllers must ensure the integrity and confidentiality of personal data by implementing appropriate technical and organisational measures.
A simple way to ensure this is through protocols that transmit data in a peer-to-peer (P2P) fashion, such as TRUST and TRP. When data is transferred P2P, there is no middleman, thereby significantly reducing the risk of intermediaries accessing this information.
Read more about peer-to-peer transactions and the Travel Rule.
2. Data Transparency and the Minimum Data to be Collected
Per Articles 5(1)(c) and 5(1)(a), only the minimum necessary data is to be collected and processed. Moreover, individuals must be informed about how their data is used, in line with the principles of lawfulness, fairness, and transparency.
Additionally, should a data breach occur, organisations must report it to the relevant Supervisory Authority within 72 hours of becoming aware of it, unless the breach is unlikely to pose a risk to individuals’ rights and freedoms. [Article 33(1)]
3. Compliant Cross-Border Data Transfers
The GDPR permits the transfer of personal data across borders (outside the EEA) under certain conditions, as explained in Chapter V (Articles 44–50). These transfers can occur when countries have been deemed to have an adequate level of protection or when appropriate safeguards, such as standard contractual clauses or binding corporate rules, are in place.
21 Analytics ensures compliant cross-border transfers at all times. Data transfers via our Travel Rule solution occur directly between counterparties; at no time do we have access to any sensitive customer data, nor are central intermediaries involved in the data transfer.
Parting Thoughts
VASPs face a challenge with the Travel Rule and the GDPR. The EU’s Travel Rule requires the sharing of sensitive data, whereas the GDPR imposes strict restrictions.
VASPs need to strike a balance between complying with both regulations. This means choosing a Travel Rule solution that offers a secure exchange of Travel Rule data, is privacy-preserving, and complies with the GDPR.
With 21 Analytics, VASPs are guaranteed direct Travel Rule data flow to their counterparties with zero middlemen, ensuring compliance with the Travel Rule and the GDPR.
Learn more about the only GDPR-compliant Travel Rule solution - request a demo today.
