Cardano Foundation partners with Reef Data to monetize personal data via GDPR-compliant cooperative
In brief
- Cardano Foundation partners with Reef Data eG, backed by Hamburger Volksbank, ARIC, VALIO, and Disruptive Elements.
- Reef pools member personal data, licenses it to businesses, and distributes royalties via Cardano's Reeve accounting system.
- Model maintains GDPR compliance by keeping personal data off-chain and applying anonymization at source.
How Reef's Data Cooperative Works
Reef plans to pool members' personal data and license it to businesses, with Cardano's Reeve system recording payment flows and royalty distributions at the accounting layer. The underlying data stays off Cardano's blockchain.
Reef's app keeps personal information off Cardano at the source, reviewing and anonymizing each member's data on their phone, and only the member's own choice sends anything into the cooperative's pool. Reeve logs sales, timestamps royalty payments, and anchors records cryptographically so members and auditors can verify distribution followed published rules.
This architecture addresses a critical regulatory tension. The European Data Protection Board adopted final guidance on blockchain technologies on July 7, warning that immutable ledgers conflict with GDPR's erasure and correction rights. By storing data off-chain and using Reeve only for transaction integrity, Reef sidesteps that friction.
Reef's Commercial Model vs. Other Data Intermediaries
The European Commission Joint Research Centre identifies six models of data intermediary. The EU Data Governance Act requires recognized data providers to register with national authorities and appear in a public list. That list was updated on July 28 and names 36 providers across 10 countries.
Reef pushes further into commercial territory than most peers. Switzerland's MIDATA Cooperative lets members store health records and grant researchers access under member governance but operates as a nonprofit and centers participation in research over payment. Spain's SalusCoop asks citizens to conditionally donate health data for research, prioritizing collective and public benefit over individual royalties.
By contrast, Reef pushes further into commercial territory, selling datasets to buyers and distributing royalties under published, auditable rules. Reef's published workflow says members request their own information from companies under the EU Data Act, which has been applicable since September 2025.
Privacy and Compliance Constraints
The model's privacy foundations rest on two EU legal pillars. GDPR Article 15 gives people a right to access data companies hold on them, and Article 20 covers data portability in a machine-readable format. Those rights let members extract their data from companies and feed it into Reef's pool.
Yet a subtle distinction matters. EU data-protection authorities separate true anonymization from pseudonymization. Pseudonymized data still counts as personal information whenever a technique or dataset combination can link it back to a person. If Reef's anonymization doesn't meet the true-anonymization standard, the pooled dataset remains subject to GDPR's full weight, including erasure requests that could conflict with immutable record-keeping.
