We Know What's in Your Wallet: Data Privacy Risks of a Central Bank Digital Currency.

• Author: Hangen, Thompson J.

TABLE OF CONTENTS I. INTRODUCTION 83 II. BACKGROUND 86 A. While a Central Bank Digital Currency May Be Built on a Blockchain, it is Distinct from Cryptocurrencies or Other Digital Ledger Tokens 86 1. Blockchain Technologies Combine Existing Technologies into a Ledger-Based Tool for Storing and Distributing Information 86 2. A Central Bank Digital Currency is Distinct from Cryptocurrencies and Stablecoins 89 B. A Central Bank Digital Currency Gives Powerful Monetary Policy Tools to the Government but Poses Inherent Privacy Risks 92 1. A Central Bank Digital Currency Provides Monetary Policy Tools to Ensure Equitable Access to Online Financial Payment Methods 92 2. Data Aggregation Creates Significant Risk for Consumer Data Privacy 94 III. FEDERAL FINANCIAL DATA PRIVACY: THE GRAMM LEACH-BLILEY ACT 96 IV. PROPOSED DATA PRIVACY STANDARDS FOR CENTRAL BANK DIGITAL CURRENCIES 98 A. The Federal Reserve System Has Not Addressed Data Privacy Concerns Inherent in CBDCs 98 B. Solutions to Protect Consumer Data Privacy Include Commercial Bank Incentives, FRS Reform, and Legislation to Expand the Gramm-Leach-Bliley Act 100 V. CONCLUSION 102 I. INTRODUCTION

Governments worldwide are interested in developing and issuing digital currencies, also known as central bank digital currencies ("CBDC," or plural, "CBDCs"). (1) A CBDC is issued by a central bank using technology similar to cryptocurrencies (2) and is legal tender. (3) Issuing a CBDC may give governments additional powerful monetary policy tools, (4) but because of the technology involved, also allows governmental agencies to collect massive amounts of identifiable financial data. (5) Where consumer data is collected, consumer data should be protected; when that collection includes every single system transaction, data must be all the more strictly guarded. (6)

The Federal Reserve System ("FRS"), which operates as the central bank in the United States, is responsible for "conducting the nation's monetary policy" and "promoting consumer protection." (7) Implementation of a central bank digital currency in the United States would provide additional policy levers to conduct monetary policy but would also extend the role of the FRS from "promotion" of consumer protection to active collection of consumer data at an unprecedented level. (8) This consumer data would connect an individual to every single financial transaction they, or others connected to them, make using a CBDC. (9) While this data could likely be anonymized, it could still be possible to connect an individual to data--including their demographic data, geographic location, financial transaction history, and even the types of personally identifiable information generally collected by banks today to open an account. (10) This massive amount of information carries unique risks for consumers if compromised. (11) Safe implementation of a CBDC requires both stringent legislation aimed at safeguarding consumer data and the institutional competence within the FRS necessary to realize such safeguards.

The Federal Reserve has indicated that development of a CBDC for the United States is a "priority." (12) While development and implementation could take years, appropriate data privacy protections must be built into the development of a CBDC from the outset. (13) Information from the FRS about how a CBDC might be implemented in the United States is still under discussion and may yet include some protection for consumer data. (14) However, adequate data privacy standards, discussed in Section IV below, will likely require an expansion of federal laws (such as the Gramm-Leach-Bliley Act) to cover the unique types of data collected as part of the routine functionality of a CBDC. (15) Such coverage would require Congress to explicitly expand the scope of the FRS. (16)

Interest in a central bank digital currency is not limited to the United States; as of May 2022, at least 87 countries, representing more than 90% of global GDP, are exploring, actively developing, or in the process of implementing a CBDC. (17) Seven countries have fully implemented a CBDC, and an additional seventeen are currently piloting one. (18) At the 2021 G7 Summit, member countries (19) released thirteen principles to which a CBDC should adhere, demonstrating the importance of near-term CBDC development to major world economies. (20) The G7 recognized that each nation's data privacy laws differ but agreed that generally, a CBDC "must protect the privacy of users, including by requiring that the processing of their personal data is subject to laws governing privacy and the collection, storage, safeguarding, disposal and use of personal data that are enforceable in the jurisdiction." (21) However, notwithstanding the emergence of CBDCs worldwide, there exists no comprehensive data privacy standards or guidelines that countries can use as a benchmark for consumer data protection. (22)

To address these interests, Congress should explicitly expand the scope of the FRS. (23) Section II.A of this Note provides a high-level discussion of technologies used to create blockchains and how they can be used to create a centralized ledger for central bank digital currencies, as well as a discussion of how CBDCs differ from more common cryptocurrencies. Section II.B considers the case for and against issuance of a CBDC, including data privacy concerns. Section III reviews how federal financial data privacy laws (especially the Gramm-Leach-Bliley Act) currently provide for consumer data protection and storage, and the extent to which such laws might cover CBDC-related data. (24) Section IV urges Congress to enact a unified data privacy standard that encompasses CBDC data and to empower the Federal Reserve System to collect, safely store, and protect consumer data. Section V concludes by proposing a mechanism to implement data privacy standards for CBDC use.

2. BACKGROUND

   This section covers the basics of how blockchain technology works, and how a central bank digital currency might be implemented. It also discusses how a CBDC compares to other forms of digital currency and what benefits and risks they might contain. (25)

   1. While a Central Bank Digital Currency May Be Built on a Blockchain, it is Distinct from Cryptocurrencies or Other Digital Ledger Tokens

      While blockchain-based technologies are increasingly in the public eye, they remain an emerging area of technology and law. Accordingly, a non-technical primer of blockchain technologies, how the technology operates, what use cases exist, and what a CBDC is follows.

      1. Blockchain Technologies Combine Existing

         Technologies into a Ledger-Based Tool for Storing and Distributing Information

         Blockchain is not a new technology; rather, it is a novel combination of existing technologies to allow for the decentralized storage and distribution of information. (26) Blockchain combines concepts such as peer-to-peer networks (e.g., the Internet), cryptographic keys (used in many secure messaging systems), democratic consensus mechanisms, and digital signatures. (27) The resulting combination allows for a unique system of storing and distributing information: a decentralized ledger that shows up-to-date information on ownership of assets and how entities have interacted with each other over time (i.e., a ledger of transactions between blockchain participants). (28)

         The Internet itself exists as a series of protocols that define how individuals can interact with it. (29) These protocols are a universal language that any computer or device must "speak" to access the Internet, and as such, they draw limits around what can or cannot be done by people interacting with the network. (30) Traditionally, governments have been able to implement layers of protocol that prohibit or enable certain actions, allowing for control over digital content and actions of citizens within their borders. (31) Blockchain technologies exist as another layer of protocol, analogous to another "application" layer. (32) Blockchain protocols allow individuals to interact with the defined protocol to access information on ownership and submit changes (generally being transactions between users) to that information. (33) Whether those changes are accepted relies on how the protocol of the blockchain is defined. (34)

         Blockchains typically use peer-to-peer networks: a distributed network where participating computers connect with each other in a one-to-many relationship, rather than each computer connecting to a central server. (35) Each computer in the network communicates using the same blockchain protocol to validate, store, and distribute information. (36) By storing the complete transactional history of the blockchain on each participant computer, the network is resistant to change, and information is validated by consensus. (37) If a majority of participant computers validate a transaction stored in the ledger, that "block" of transactions is added to the "chain"--forming a comprehensive ledger of all previous transactions. (38) Accordingly, blockchains are largely autonomous, where changes to the blockchain are implemented through democratic consensus mechanisms rather than a central authority. (39)

         Blockchain users maintain a private key (40) (a lengthy alphanumeric code) known only to them. (41) As demonstrated in Figure 1, below, this private key is used as the input for a cryptographic algorithm to generate a public key, which is used to publicly sign transactions. (42) A public key is unique to a single private key, and users maintain it by keeping the private key confidential. (43) While a user may input a private key to access the blockchain, only the output of the cryptographic algorithm (the public key) is stored within the blockchain ledger. (44) Knowledge of the public key does not necessarily reveal any information about the user, although it may mean that an individual's transactions may be tracked if the public key is connected to...