In recent years, many organizations have begun to seriously experiment with applications built on blockchain technology as a means to improve operational efficiency, build greater transactional transparency and to ensure that they are well positioned to take advantage of the benefits of this technology. While there are numerous existing and potential blockchain applications, the most advanced and promising one remains smart contracts.
Smart contracts are among the most foundational components of the emerging blockchain ecosystem. They hold the potential to bring about widespread efficiency gains across sectors such as financial services, healthcare, and energy, particularly in conjunction with other developing technologies such as artificial intelligence, the Internet of things (consumer and industrial) and robotic process automation. The application of blockchain technology to smart contracts offers many benefits, such as operational simplification, counterparty risk reduction, clearing and settlement time reduction, and fraud minimization.
However, as this technology becomes more widespread and is adopted by corporate and financial organizations, many important technical and legal concerns have come to light. Issues related to cybersecurity, privacy, contract law and technical limitations have arisen as key concerns, which must be considered by organizations prior to the implementation of smart contract-based solutions. From determining if smart contract technology should be used at all, to customizing, applying and monitoring the technology, in-house counsel and other related players must be aware of the limitations, challenges and risks associated with this new technology.
BLOCKCHAIN: A PRIMER
In its simplest form, a blockchain is a distributed ledger—that is, a list of transactions that is shared among a statistically relevant number of computers, rather than being stored on a central server. Blockchain technology is attractive for a large variety of industries, as different types of data can be added to such a ledger. Some common types of data that are stored on blockchain networks are, for example, cryptocurrency, transaction information, contracts, data files, photos, videos and design documents. As such, blockchain technology constitutes a computerized public ledger that can be used to store almost anything that may traditionally be saved to a spreadsheet or database. Prior to being added as a block to a blockchain, a transaction must have its integrity confirmed through a “consensus mechanism” by which various computers in the system must agree to update the blockchain after any legitimate transaction has taken place. This means that, instead of a single database, there are multiple shared copies of the same information held by the participants of the network.
As noted above, to add a transaction, or a point of data, as a block in the chain, the information must first have its integrity confirmed by the group. Depending on the network, various methods are used to secure this confirmation, with the most well-known being the “proof of work” method, where the computer must solve a mathematical puzzle.
Once a block is validated and added to the ledger, it cannot be changed without the validation of the entire network. Blockchain therefore creates a permanent and immutable public record, since the integrity of data on the ledger is kept up-to-date collectively. While all network participants can examine the data on the blockchain, it can only be amended by general agreement between the participants and according to a strict set of rules. This decentralization of modification power is one of the main appeals of blockchain technology.
In practice, there are several types of blockchain networks, which apply different permission levels to different categories of participants:
- Public blockchains are accessible to all. Anyone can record a transaction, take part in the validation of the blocks or access a copy of them.
- Permissioned blockchains have rules which set out who can take part in the validation process or even register transactions. They can, depending on the case, be accessible to all who follow the applicable rules or restricted to specific participants.
- “Private” blockchains are controlled by a unique actor who oversees participation and validation.
WHAT IS A SMART CONTRACT?
Smart contracts are self-executing electronic instructions drafted in computer code. This allows a computer to "read" the contract and, in many instances, self-execute the stipulations of an agreement when predetermined conditions are triggered. This is commonly done using “if ‘X’ then ‘Y’” protocols where if a certain condition is met (“X”), then a specific measure can be implemented (“Y”). For this to work, there must typically be some clear-cut input to the code underlying the smart contract (e.g., via data feed) allowing the contract to implement the "if X, then Y" instructions.
The parties to the contract typically "sign" the agreement using a cryptographic security code and deploy it to a distributed ledger or blockchain. When the conditions built into the code are satisfied, the program automatically triggers the required action.
While self-executing contracts as a concept pre-date the emergence of blockchain technology, the modern conception of a smart contract puts such technology to use. The key characteristics of today’s smart contract include the following:
- It is digital, in computer form—code, data and running programs
- Contractual clauses, or equivalent functional outcomes, are embedded as computer code.
- They allow for performance mediated by technological means.
- The contract is irrevocable. Once initiated, the outcomes that a smart contract is encoded to perform cannot typically be stopped, unless the preconditions for such outcome are never met.
Currently, most smart contracts: (i) are relatively simple; (ii) do not govern complex contractual relationships; (iii) are comprised of relatively basic “if/then” protocols on top of a blockchain platform. That said, it is expected that as the adoption of smart contracts increases, that their complexity and adoption will also increase.
KEY LEGAL CHALLENGES
Corporate and financial institutions are developing a vast range of uses for smart contracts, from issuing and transferring securities, clearing derivatives, tracking the ownership of commodities for trade finance transactions, and arbitraging energy consumption, to passenger identity verification and ticketing. As the adoption of blockchain continues, legal challenges have become more evident, in particular issues related to cybersecurity, privacy, contract law and technical limitations.
Past Cyber Incidents
Blockchain technology is often touted as being “secure” given that the data is distributed across many computers, making it difficult, in theory, to be tampered with. However, this does not mean that third parties cannot exploit vulnerabilities in the underlying code upon which the smart contact is built. As illustrated from the examples below, such concerns are not merely hypothetical.
Vulnerabilities in the code have been exploited in at least three multi-million-dollar cyber incidents. In June 2016, the so-called Decentralized Autonomous Organization ("DAO") was hacked, whereby a vulnerability in the smart contract code was exploited, resulting in the unauthorized transfer of $50 million dollars.
DAO was an investment fund designed to run automatically, without management or a board, and was built on the Ethereum platform. The concept was relatively simple: to have a leaderless, decentralized venture capital firm that would allow investors to vote on and collectively fund proposals. On June 17, 2016, an unknown individual withdrew approximately $55 million from the DAO by exploiting flaws in the code. Interestingly, the principal coder for DAO had warned that the code needed more testing and that there may be unknown vulnerabilities.1
Similarly, in July 2017, a vulnerable code in an Ethereum wallet was exploited to extract $30 million dollars of cryptocurrency. The issue was the result of a bug in a specific multi-signature contract.2
In January 2018, hackers stole roughly $532 million from Coincheck Inc., a Tokyo-based cryptocurrency exchange. This incident stressed the need for increased security and regulatory protection for cryptocurrencies and other blockchain applications. This incident appears to have exploited vulnerabilities in a “hot wallet,” a crypto currency wallet connected to the Internet. In contrast, cold wallets are stored offline.3
Key Considerations for Businesses
While smart contracts, and blockchain in general, are often seen as secure systems, in part due to their decentralized nature, these incidents demonstrate that this security is not absolute. Organizations must be aware of cybersecurity risks before they decide to implement smart contract solutions, and take appropriate measures to ensure effective security for the permissioned blockchains they deploy. One important strategy used to maintain the integrity of the ledger is to evaluate the minimum number of miners that could collude and overpower the chain and ensure that the number of legitimate miners is always above this threshold. Companies should also establish technical and organizational procedures that reduce the potential for vulnerabilities in the system and put in place an emergency plan to be deployed in the event of such a failure.
Application of Canadian Privacy Laws
When an organization stores personal information about an individual on a blockchain network, they must comply with Canadian privacy laws which apply to such information. Even if the organization already has in place protocols for compliance with these laws, they should be aware that the architecture and characteristics specific to blockchains have consequences on how personal information is stored and processed.
A blockchain can contain two categories of personal information:
- Participants’ and miners’ personal information: each participant and miner has a public key, ensuring identification of the issuer and receiver of a transaction; and
- Personal information contained “within” a transaction: such data may contain information about an identifiable individual, possibly other than the participants, who may be directly or indirectly identified. Such data is considered personal information.
Generally speaking, privacy laws are designed to regulate a world in which personal information management is centralized, where the controller of such personal information (“data controller”) and defined third parties who merely process the data (“data processors”) are clearly identified. Applying these concepts to a decentralized network such as blockchain, where a multitude of actors control and process the data, requires a careful analysis of the different players involved on a network, namely (i) the “accessors,” who have the right to read and hold a copy of information stored on the chain; (ii) the “participants,” who have the right to make entries (i.e., make a transaction for which they request validation); and (iii) the “miners,” who validate a transaction and create blocks by applying blockchain rules for acceptance by the community.
While there is no general consensus on how privacy laws are to be applied to information stored on blockchain ledgers or to the responsibility assigned to each of these players, we can look to the French privacy regulator (the “Commission nationale informatique liberté” or “CNIL”) for some guidance. The CNIL considers that participants on a blockchain network who can write on the chain and send personal information to be validated on the network must be considered data controllers. This is the case, for instance, where the participant is registering personal information that relates to a professional or commercial activity on the blockchain. By contrast, according to the CNIL, the miners who only validate the transactions on the network can in certain instances be acting as data processors. Consequently, data processing agreements need to be in place between the data controllers and the data processors on any blockchain network. As increasing amounts of personal information are stored on decentralized networks, privacy regulators will need to turn their minds to the application of their laws to such practices. This includes Canadian privacy regulators that have provided no formal guidance on how they would view the storing of personal information on blockchain.
Depending on the circumstances, these technologies are likely to raise privacy compliance issues. Blockchain technology will not always be the most suitable solution for all processing operations. Some aspects, such as the implementation of obligations concerning sub-contracting or the rules governing international transfers of personal information, require particular attention. Organizations should assess the advantages and disadvantages resulting from the implementation of blockchain technology.
In light of the above, certain points of uncertainty relating to the application of privacy law principles to the use of blockchain technologies. Organization processing personal information on such systems should be aware of the following issues:
- How to manage data processors on a public blockchain. Where an organization opts for a public blockchain, entering into data processing contracts that comply with privacy laws is not always feasible. While putting in place such agreements is more straightforward in the context of private and permissioned-based blockchains, it remains difficult to manage data processors on a public blockchain.
- Cross-border data transfer on a public blockchain. Where participants on a blockchain network are spread across numerous countries, compliance with cross-border data transfer obligations will need to be addressed. Once again, while solutions such as data protection agreements may be easier to implement for permissioned blockchains, appropriate cross-border safeguards will be more difficult to implement on public blockchains.
- Data retention. One of the most widely recognized tensions between blockchain and privacy laws is the inability to delete personal information on the network, making it difficult to comply with data privacy principles such as data minimization, but also for ensuring the effective exercise of a data subject’s rights.
Key Considerations for Businesses
Organizations should concretely assess the true necessity of implementing blockchain technology, in light of the objectives and characteristics of each processing operation. While all uses of blockchain can carry risks relating to privacy compliance, the use of a public blockchain in particular raise particular concerns.
In addition to questioning the use of a blockchain altogether, the data controller must also question which type of blockchain is best suited to their needs. The choices made by data controllers (for example, between a permissioned blockchain and a public blockchain, or between different formats for recording data on blocks) can have significant impacts on risks to individuals’ rights and freedoms. In order to comply with Canadian privacy laws, organizations should consider blocking access to personal information depending on the format chosen.
Whenever possible, personal information should be processed outside of the blockchain, particularly where the data is not encrypted, or processed using a cryptographic solution which makes the data practically inaccessible.
Where groups of companies wish to undertake processing operations based on a common purpose on a blockchain, they should clearly define and allocate the data controller responsibilities among the members of the group.
Finally, carrying out a privacy impact assessment allows organization to undertake an analysis of the necessity and proportionality of implementing a blockchain-based mechanism and allow them to identify circumstances in which other solutions may be more suitable.
A third key issue tied to the use of smart contracts is whether they can be properly characterized as contracts at all. While this concern may seem strictly theoretical, a determination that smart contracts are not deemed to be contracts under Canadian law could have potentially far-reaching consequences.
While all of the Canadian provinces and territories have enacted statutes governing electronic transactions and electronic commerce which provide for the legal recognition of information and documents, including contracts, which are communicated electronically, such legislation remains silent on a number of fronts of significance to smart contracts.
Under Canadian law, for a promise to be considered a legally enforceable and binding contract, many requirements must be satisfied. For example, the contract must contain multiple parties, the parties must have the requisite capacity to enter into the contract and mutually assent to it, and, in most Canadian jurisdictions (except for Québec), the contract must contain consideration. Generally, Canadian courts have been willing to enforce Internet contracts, which suggests they may be amenable to enforcing smart contracts. However, it remains unclear how smart contract users will demonstrate that all of the legal requirements for contract formation have been met in the proposed smart contract solution into which the parties have entered.
Canadian jurisprudence tends to focus on the following four requirements when determining the validity of an electronic agreement:
- both parties must have sufficient notice of the terms of the contract, removing uncertainty as to the terms;
- there must be an opportunity to consider and decline the contract;
- there must be evidence of mutual acceptance of the contract; and
- there must be no unconscionable contractual terms.
By considering the application of such requirements to electronic contracts in general, and to smart contracts in particular, we can distill some high-level guidance regarding if Canadian courts will recognize the validity of smart contracts.
Offer and Acceptance
For a contract to be binding, there must have been a valid offer and acceptance by the parties to the contract. The determination of exactly what kind of electronic communication constitutes such offer and acceptance remains unclear.
Broadly speaking, following decisions by Ontario and Québec courts,4 the enforceability of click wrap agreements is widely recognized in Canada when the adhering party has agreed to enter the contract by a positive action.5 However, the validity of electronic contracts where acceptance is not explicit (for example, shrink-wrap agreements) has not been as clearly recognised and their validity will depend on the circumstances of each case.
In light of the above, if one party designates a smart contract to a distributed ledger, potential issues could arise as to whether there has been valid offer and acceptance. The smart contract itself could designate what constitutes offer and acceptance, but there is no guarantee that courts will accept this designation.
The concept of reasonable notice of the terms of the contract is also critical when it comes to the enforceability of electronic agreements, especially since such notice promotes certainty of the terms of the agreement. The presence of sufficient notice will be considered when determining if parties have validly accepted a contract. Theoretically, it appears Canadian courts would be open to finding that acceptance can be validly given through the means of a smart contract provided that the parties had sufficient notice of what was being offered and accepted.
On the other hand, establishing reasonable notice in respect of a piece of computer code could be challenging. Inherently, it would be difficult to fully and accurately explain the code to both parties, especially if they are not well versed in coding and may not appreciate the scope of what they are potentially agreeing to. Thus, establishing mutual agreement between the parties in respect of the code may be problematic, as the parties’ understanding of the code may differ. These differences in understanding would likely be exacerbated in situations where one or both of the parties are mistaken in their understanding of the code. Given the absence of authority on this point in Canada, it remains unresolved whether so-called “follow-on” contracts initiated by a smart contract could have binding effect.
While it is not entirely clear how Canadian courts will treat smart contacts, it is reasonable to anticipate that they will not take a fundamentally different approach to contract law in relation to a smart contract from that routinely applied in relation to more traditional contracts.
Unconscionability is another area of significant concern to Canadian courts in their analysis of electronic agreements, and would therefore apply to their analysis of smart contracts. Canadian courts have found that an agreement is unconscionable, and therefore potentially unenforceable, where three elements are present:
- there is an inequality of bargaining power;
- the stronger party preyed upon the weaker one; and
- the result was an improvident agreement.
Questions about unconscionability are particularly relevant in the context of electronic agreements where one party is often a large corporation making an offer to a single consumer (commonly referred as “B2C” contracts). It is likely that smart contracts between parties on similarly unequal footing would be subject to the same scrutiny.
An additional challenge facing the implementation of smart contracts in place of traditional contracts arises at the intersection of contract requirements and the current limitations on what can effectively be coded into the contract. The immutability and relative inflexibility of coded contracts could raise potential difficulties.
Immutability can be an issue where an event or change of circumstances that the parties have not foreseen in their coding of the contract arises following the conclusion of the smart contract. For example, a smart contract can be used to place money into escrow and both parties may intend for the money to be released following the satisfaction of certain conditions. However, if these conditions are not satisfied, the money may be “trapped” in escrow indefinitely, as the code will refuse to release the funds, possibly even if both parties agree that it should be released. Additionally, as it may be difficult to translate more nuanced or subtle concepts into code, smart contracts can be seen as less flexible than traditional contracts. For example, while a clause tied to a specific mathematical formula may be easily turned into code, the same is not necessarily true for concepts such as “commercially reasonable.
Beyond these two issues, many small areas of technical limitations may cause significant issues in a smart contract system:
- Coding errors may cause unexpected performance issues.
- Parties may want to terminate a smart contract for repudiatory breach or unwind it on the grounds of misrepresentation, mistake or duress.
- Subsequent changes of law or regulation may make performance of the smart contract illegal.
- Smart contracts may perform on the basis of an inaccurate data feed.• Smart contracts can be executed pseudonymously. In those cases, it may be difficult to identify someone to bring a claim against.
- As smart contracts operate via distributed nodes (computers), which may be based all over the world, it may be difficult to determine the applicable governing law and jurisdiction; it also increases the risk of satellite disputes over such issues.
While many of these difficulties could potentially be solved through careful coding and planning, it’s very possible that a situation may arise that the parties have not foreseen. In traditional contracts, there is more of an opportunity to renegotiate and solve such issues.
Blockchain technology and smart contracts have the potential to positively transform corporate institutions. Assuming that the technology is further developed and broadly adopted, smart contracts will need to meet the same legal standards as traditional paper agreements. In the implementation of such systems, organizations must remain aware of the ongoing issues and outstanding questions raised by the use of smart contracts, and structure their operations to minimize the inevitable risks that are, at least for the time being, associated with their use.
Given the significant costs associated with building smart contracts and the underlying infrastructure to support them, businesses should also invest resources in developing a legal architecture built on existing statutory and judicial guidance. This approach will avoid unnecessary issues down the road.
- David Siegel, Understanding The DAO Attack, Coindesk (June 27, 2016).
- Wolfie Zhao, $30 Million: Ether Reported Stolen due to Parity Wallet Breach, Coindesk (July 19, 2017).
- BBC News, Coincheck: World's biggest ever digital currency 'theft' (January 27, 2018).
- Dell Computer Corp. v. Union des consommateurs, 2007 SCC 34; Rudder v Microsoft Corp,  O.J. No. 3778.
- Click-wrap agreements are a type of contract that is widely used with software licences and online transactions in which a user must agree to specific terms and conditions prior to using the product or service.
- 2011 BCSC 1196.