Author: Öznur Uğuz, MSc in European Economy and Business Law at the Tor Vergata University of Rome, 2021-2023
Legal Editor: Bader Kabbani, LLM International Commercial and Economic Law, SOAS, University of London, 2020-2021
Abstract
Recent advancements in technology and innovation combined with the accelerating effects of the Covid-19 pandemic on the digitalisation movement have significantly changed the nature of financial services. Financial services have been increasingly digitalised and alternative forms of exchange, such as digital currencies, have been introduced to our lives. Central Bank Digital Currencies (CBDCs) are the response of central banks to the digitalisation trend in the financial sector as well as a move to reinforce their position in the monetary system. In this article, I will explain what a CBDC is and what benefits it may bring to the financial system, and conclude by briefly discussing the risks CBDCs may pose in terms of data protection and security.
What is a Central Bank Digital Currency?
According to the Atlantic Council’s Central Bank Digital Currency tracker, as of March 2023, 114 countries were exploring CBDCs, whose combined economies constitute more than 95% of the world’s GDP. In the meantime, eleven countries, including China, India, and Nigeria, have already launched their CBDCs. Since the majority of the world’s central banks, including the largest economies such as the United States and China, are already searching for the possibility to develop their CBDCs, it is important to understand what they are and what benefits and challenges they may bring to the international financial system.
A Central Bank Digital Currency (CBDC) is a digital payment instrument issued by a country’s central bank. There are various types of CBDCs such as account-based/token-based, wholesale/retail, centralized/decentralized, and direct/indirect CBDCs, which differ in terms of design features, centralization level, and access modality. While each type has its unique features, some characteristics are common for all CBDCs.
The key feature distinguishing CBDCs from other digital means of payment is their legal tender status. This means that CBDCs have to be accepted if offered for payment within the jurisdiction of the country they are issued in, whereas other digital means of payment can be refused. A CBDC is a liability of the central bank that has issued it, meaning that the parties of a transaction made with a CBDC will have a direct claim against the issuing central bank. Unlike cryptocurrencies which are almost always decentralized and volatile, CBDCs are managed by central banks and have the same value and security as a fiat currency. Being a fiat currency itself, a CBDC is also different from a stablecoin, which is a digital currency pegged to a stable asset such as a fiat currency like the US dollar or gold.
Potential Benefits
CBDCs can stimulate innovation and competition in the financial market and address many issues in the financial system in terms of efficiency, security, speed, and access. They can reduce barriers to cross-border payments and speed up transactions while lowering costs by reducing the need for physical infrastructure and intermediaries. CBDCs also promote financial access and inclusion by providing those without a bank account with digital and easy access to finance through mobile devices.
Given their legal tender status, CBDCs eliminate the risks emanating from third parties such as bank runs and failures since any residual risk in the system lies with central banks. This would reduce the risk of solvency and increase financial stability. With their advanced design features enabling unalterable and traceable transactions, CBDCs also have the potential to increase the security and transparency of financial transactions. The heightened security and transparency they provide may also help prevent money laundering, tax evasion, terrorist financing, and fraud.
Main Legal Concerns: Data Protection and Security
CBDCs raise several questions under different branches of law, particularly from the perspectives of monetary law, central bank law, property law, privacy law, and data protection law. That said, the legal implications and the regulation of CBDCs will mostly depend on their design and implementation features. Some types of CBDCs, such as wholesale CBDCs, are already in use and easier to define and regulate under existing legal frameworks, while the legal status of others is currently unclear. Nevertheless, all types of CBDCs generally present challenges regarding data protection and security to a greater or a lesser extent.
The potential broad impact area of CBDCs requires particular attention to be given to data protection and privacy principles as CBDCs will require large-scale data processing, potentially affecting the whole population of a country where a CBDC is issued. CBDCs are naturally more transparent and traceable compared to other private digital payment methods that promise anonymity. This might be beneficial in terms of hindering illegal activities that rely on anonymous transactions such as money laundering and terrorist financing. However, such a high degree of transparency also generates serious risks of profiling and mass surveillance of citizens by governments, which would constitute a threat to the fundamental rights of citizens as data subjects. The ability of governments to track the payment information of citizens and intervene might also give rise to restrictions on the spending of CBDCs on certain goods or activities like alcohol and gambling as well as to the prevention of transactions with certain individuals or institutions.
When it comes to data security, cyber-attacks, credential theft and loss, and counterfeiting through modern cyber-attack techniques such as social engineering and side-channel attacks are possible risks as are for other digital payment systems. Another important security risk arises from the concentration of immense amounts of payment data of citizens in databases of central banks. This high amount of data in one place might create incentives for cyberattacks and aggravate the risk of systemic surveillance.
Possible Solutions
The risks CBDCs pose in terms of privacy, data protection, and security can be mitigated or amplified by design choices. To ensure the better protection of users’ data and privacy, data protection principles should be embedded into the research and development process of CBDCs from the beginning by adopting a data protection by design approach. Data protection impact assessments also need to be conducted over different stages of a CBDC project to ascertain that data protection principles are respected thoroughly. In terms of the retention of data collected from users, a legal limitation on the retention period depending on the purpose of each data processing is essential, which would also reduce the risk of data breaches. Regarding the transmission of user data, the use of privacy-enhancing technologies would be beneficial to ensure that information shared between transaction partners and other public authorities related to data subjects is limited to a minimum.
Regarding security, the implementation of a comprehensive cybersecurity strategy and the establishment of strong technical governance and resilience by central banks are pivotal to successfully handling security risks. In addition, central banks should closely follow the new developments in technology and should be prepared to respond to unanticipated risks that might stem from the complex and unprecedented nature of CBDCs.
References
Browning S, ‘Central bank digital currencies: The digital pound’ (8 March 2023) <https://researchbriefings.files.parliament.uk/documents/CBP-9191/CBP-9191.pdf> date accessed 26 April 2023
Mims C, ‘Central-Bank Digital Currencies Are Coming—Whether Countries Are Ready or Not’ (16 January 2023) < Central-Bank Digital Currencies Are Coming—Whether Countries Are Ready or Not – WSJ> date accessed 26 April 2023
Leucci S, Attoresi M, Lareo X, ‘TechDispatch #1/2023 – Central Bank Digital Currency’ (29 March 2023) < TechDispatch #1/2023 – Central Bank Digital Currency | European Data Protection Supervisor (europa.eu)> date accessed 26 April 2023
Cointelegraph, ‘What are CBDCs? A beginner’s guide to central bank digital currencies’ <What are CBDCs? A beginner’s guide to central bank digital currencies (cointelegraph.com)> date accessed 26 April 2023
Seth S, ‘What Is a Central Bank Digital Currency (CBDC)?’ (19 March 2022) < What Is a Central Bank Digital Currency (CBDC)? (investopedia.com)> date accessed 26 April 2023
McKinsey & Company, ‘What is central bank digital currency (CBDC)?’ (1 March 2023) < What is CBDC (Central Bank Digital Currency)? | McKinsey> date accessed 26 April 2023
Reynolds B, Parisi D, ‘The missing legal framework for central bank digital currencies’ (19 October 2021) < The missing legal framework for central bank digital currencies | Reuters> date accessed 26 April 2023
Bossu W, Itatani M, Margulis C, Rossi A, Weenink H, Yoshinaga A, ‘IMF Working Paper: Legal Aspects of Central Bank Digital Currency: Central Bank and Monetary Law Considerations’ (November 2020) < https://www.imf.org/en/Publications/WP/Issues/2020/11/20/Legal-Aspects-of-Central-Bank-Digital-Currency-Central-Bank-and-Monetary-Law-Considerations-49827 > date accessed 26 April 2023
Deloitte, ‘Central Bank Digital Currencies: Building Block of the Future of Value Transfer’ (2022) < https://www2.deloitte.com/content/dam/Deloitte/au/Documents/financial-services/deloitte-au-fsi-central-bank-digital-currencies-100322.pdf > date accessed 26 April 2023
This article is written within the Academic Essay Project (AEP) organised by LAWELS. AEP aims to increase the number of quality academic writings on legal topics, encourage young lawyers to participate in academic writing, and lay the foundation of an online database on legal science. The team of legal editors and legal writers share their knowledge through high-end essays that we are publishing on our website and social media accounts for the world to read and learn from.
The articles on the LAWELS platform are not, nor are they intended to be legal advice. You should consult a lawyer for individual advice or assessment regarding your own situation. The article only reflects the views of the author.