Why does putting personal data on a blockchain make deletion legally impossible?

GDPR Article 17 gives people the right to have their personal data erased, but public and permissioned blockchains are append-only by design, so any personal data written on-chain stays there permanently. The two workarounds in use today are storing only a hash and deleting the encryption key, or keeping data off-chain with only a pointer on-chain. Neither is legally settled: regulators have not confirmed that key deletion satisfies the right to erasure, and off-chain pointers can break silently when the backing store changes. The European Data Protection Board issued Guidelines 02/2025 explicitly flagging this conflict between blockchain immutability and GDPR storage limitation principles but stopped short of providing a technical resolution. Every tokenized asset, on-chain identity, and DeFi protocol that touches regulated personal data now carries this unresolved liability.