Does Digital Currency pose a Privacy Risk? Looking at China's Digital Yuan

Created with Microsoft Bing Image Creator powered by DALL-E

Does Digital Currency pose a Privacy Risk? Taking a look at China's Digital Yuan 

In Brief: 

            China's promotion of the digital yuan in the past year and the mandatory government registration to use it have raised concerns over the unprecedented amount of government surveillance and financial control that the digital yuan has created. Such privacy risks, however, depend largely on the design and intent of the central bank digital currency (CBDC) when they are created; a CBDC that utilizes privacy-by-design and by-default can greatly improve privacy and security of users. Therefore, a better question to ask may instead be whether the improvements to privacy protection brought by well-designed CBDCs justifies taking on any increased privacy risks. 

In Detail: 

            Recently, China's digital yuan 'e-CNY' reached 100 billion yuan in transaction volume, but its growth has drastically slowed to a 14% increase in transaction volume in the past year, compared to a 154% growth in the last six months of 2021. eCNY came into prominence with its use by China in the Winter Beijing Olympics, where foreign visitors could use eCNY to buy things in the Olympic Village. Since then, the Chinese government has encouraged citizens to use the digital yuan, although growth has slowed due to existing mobile payment services such as Alipay and WeChat Pay being more convenient to use. Although the digital yuan is still in its trial phase, China is far ahead of other countries in its adoption of digital currency; the EU and US have merely begun discussions on whether the government should roll out digital currency, while India plans to launch a digital rupee this month.  

            However, eCNY also raises major privacy concerns such as government surveillance and social control. The digital yuan will allow the Chinese government to track transactions and citizen activity since digital yuan users will have to register with the government in a system of "controllable anonymity". This will also enable China's government to create or access databases of digital information regarding spending patterns, monetary trends, and investment behaviour that companies such as Alibaba and WeChat have gathered, which may in the long run remove the influence of companies that focus on the digital economy. There is also the concern that depending on digital currency controlled by the government gives an unprecedented amount of control over people's lives: some examples of this is digital currency disappearing from the accounts of those viewed as enemies of the state and being unable to travel or buy goods, or a company targeted by the Chinese government no longer receiving payments. The enhanced punitive measures that can be taken against enemies of the state or political opponents, especially in authoritarian regimes, are one of the main concerns noted by critics of central bank digital currencies(CBDCs). 

            Would the adoption of CBDCs also raise such concerns of privacy and government control in western democracies such as Canada, the United States, and Europe? The European Data Protection Supervisor's investigation into this suggests that the answer depends on how the CBDC is designed and incorporated into the financial structure of a country. For instance, CBDCs that utilize privacy-by-design and by-default can increase privacy, allowing payers more control over their personal data, and improving anonymity in the payment process as long as auditing is only allowed in pre-determined lawful cases. Nonetheless, even CBDC approaches that prioritize privacy can still retain risks, such as central banks that store the payment data becoming a more lucrative target for cyberattacks, and higher systemic risks of surveillance or privacy breaches due to unlawful access. 

            Additionally, state surveillance in itself is not an unacceptable risk to privacy, and is in fact specifically permitted in legislation in many democracies. For instance, the EU Charter of Fundamental Rights state in Articles 7 and 8 that the principles of privacy and personal data protection "must be balanced against other relevant rights and freedoms while respecting the principles of necessity and proportionality". Based on this, EU data protection authorities recommend that "transactions must be traceable only by entities with a legal mission of public interest". The GDPR also states in Section 5, Article 23 that law enforcement can be exempted from the relevant privacy rights in certain situations. Generally for such exemptions, other rules apply (for example, see this guide for law enforcement processing in the UK). Therefore, it may be more appropriate to question whether the benefits and improvements in privacy brought by CBDCs, along with the presence of enough legislative safeguards protecting individual rights, justifies new risks to privacy.