Dr Nicoleta Schiopu
email: nicoleta.schiopu@cstb.fr

Ligia Tiruta-Barna

Chapter 7 Wood preservatives

Keywords: wood preservatives, biocides, leaching, release mechanisms, treated wood toxicity

This chapter presents the main wood preservatives with respect to their potential hazard due to the biocides release from treated wood products. The chapter first discusses the toxicological properties of the actives substances and the treated wood products chemistry in the exposure conditions. Then, after presenting the main physico-chemical mechanisms at the origin of biocide release, a paragraph is dedicated to methodologies applicable to toxicity assessment in service life scenarios. The main ecotoxic effects and examples of studies at laboratory or field scale are given, followed be several trends and alternative solutions.

Introduction

Due to its abundance in nature and its versatility, the wood is one of the most important construction material mankind has ever come across. The taxonomy of woody plants is very complex. Nevertheless, it is common to classify wood in two main categories: the wood from conifers (e.g. pine, spruces, cedars, etc.) is called softwood, and the wood from dicotyledons (usually broad-leaved trees, e.g. oak, maple, birch, etc.) is called hardwood. Each one of these categories contains thousands of species. It should be mentioned that these categories are a bit misleading, as hardwoods are not necessarily hard (e.g. the balsa wood is actually softer than any commercial softwood) and softwoods are not necessarily soft (e.g. the yew wood are harder than many hardwoods).

Because of its organic nature, wood is sensitive to the biological attacks. If the wood-based product does not resist naturally to service conditions, in order to attend the performance level required by the user, an appropriate preservative treatment is carried out. The active substances used for the treatment are called biocides. The biocidal products are defined as 'active substances and preparations containing one or more active substances, put up in the form in which they are supplied to the user, intended to destroy, deter, render harmless, prevent the action of, or otherwise exert a controlling effect on any harmful organism by chemical or biological means' (EC, 1998). Thus, by definition, the biocide could be a threat to health or environment. Therefore, the retention of the biocide into the product is very important for the effectiveness of the treatment but also for the health and environmental impacts to due to its release into air, water and soil.

At the European level two main regulations concern the biocides and the construction materials with respect to the environmental and human health issues.

The Biocidal Products Directive (EC, 1998) -that will be replaced by the Biocidal Product Regulation (EC, 2011a) aims to harmonise the European market for biocidal products and their active substances including the wood preservatives which are classified as product-type 8 (PT8). At the same time it aims to provide a high level of protection for humans, animals and the environment. In order to meet this requirement, the Organisation for Economic Cooperation and Development (OECD) was charged to harmonize the methods for the assessment of the biocides. This work led to the leaching protocols presented in prCEN/TS 15119 (CEN, 2007;CEN, 2010).

The Construction Products Regulation (305/2011/EU -CPR) (EC, 2011b)-replacing the Construction Products Directive (89/106/EEC -CPD) (EC, 1989) is laying down harmonised conditions for the marketing of construction products. The CPR provides more clarification of the concepts and the use of CE marking. According to the CPR, the construction works must satisfy seven Basic Requirements (BR). Among them, the BR n° 3 Hygiene, Health and the Environment which states that 'the construction works must be designed and built in such a way that they will, throughout their life cycle, not be a threat to the hygiene or health and safety of workers, occupants or neighbours, nor have an exceedingly high impact, over their entire life cycle, on the environmental quality or on the climate during their construction, use and demolition, in particular as a result of any of the following:(…) the emissions of dangerous substances,(…) into indoor or outdoor air; the release of dangerous substances into ground water, marine waters, surface waters or soil (…)'. In order to comply with this requirement, the European Commission mandated CEN (TC 351 -Construction products -Assessment of emissions of regulated dangerous substances from construction products) to prepare horizontal (i.e. product independent) test methods with which construction products can be tested with respect to the potential release of dangerous substances to water, soil and indoor air. This chapter presents the issues linked to the environmental impacts due to the biocides released form treated wood. The potential hazard for environment may arise in different stages of the product life cycle, i.e. manufacturing, distribution, construction, service life and end-of-life. During the service life and end-of-life (disposal or recycling) stages -which both usually spread over many decades -the release of substances due to contact with the water is the main potential hazard source, as a consequence of the leaching phenomenon.

Hereafter, the main preservatives used for wood treatment are presented together with their toxicological properties. Then, the wood chemistry is described in relation to the main biocide species interaction, resulting in biocide fixation/mobilisation. The exposure conditions of wood construction materials to environmental factors and especially the water contact scenarios are determining parameters for the biocide release. After presenting the main physico-chemical mechanisms at the origin of biocide release, a paragraph is dedicated to methodologies applicable to toxicity assessment in service life scenarios, together with the main experimental tools (leaching and toxicity tests) and current regulation. The main ecotoxic effects and examples of studies at field or laboratory scale are given, followed be several trends and alternative solutions.

Types of preservatives and their potential hazard

The hazardousness of treated wood is highly dependent on the nature and intrinsic toxicity of biocides (see § 7.2.1.) and also on the release potential of these molecules. The biocides release potential depends on:

the wood chemistry with respect to interactions with the biocides (see § 7.2.2.), the exposure conditions of treated wood products (see § 7.2.3.).

The biocides types and their toxicological properties

Different classes of biocides were used in wood treatment according to the legislative constraints imposing increasingly strict conditions. Thus, in the Sixties, products as aldrin, pentachlorophenol and creosotes were usually employed. Because of the content in known carcinogenic chemicals, they were restricted or prohibited (JORF, 1992;EC, 2001). Then the alternatives were the products known under the name of 'CCA -chromated copper arsenate' which were extensively used. Nowadays, the CCA treatment is prohibited for residential constructions (with certain exceptions) (AWPA, 2001;JORF, 2004). The alternatives to these biocides are the so called 'new generation biocides' (chromium and arsenic free), such as

Copper Boron Azoles (CBA), Ammoniacal Copper quaternary (ACQ), Copper HDO (CuHDO) etc. Recently, preservatives containing micro or nano-sized copper particles have been introduced to the market (usually with 'micronized' or 'micro' designations such as MCQ or MCA).

The number of commercial preservatives products is very high but the number of active substances is relatively small. The main active substances are (FCBA, 2011):

-Inorganic : The class of toxicity of some biocides used for the wood preservation treatment is given in table 1. The classes of toxicity comply with the classification made by the World Health Organization (WHO, 2006).

Wood preservatives can be classified into four main categories:

water-borne preservatives, oil-borne preservatives, light organic solvent preservatives (LOSPs), micro and nano sized particles preservatives.

The main water-borne preservatives are: the Copper Chromium Arsenic (CCA), the Copper Azoles, the Ammoniacal Copper Quaternary (ACQ), the Copper HDO (CuHDO) and the borates based formulation.

In the CCA treatment, the copper acts primarily to protect the wood against decay fungi and bacteria, while the arsenic is the main insecticidal component of CCA. The chromium acts as a chemical fixing agent, which also provides ultraviolet (UV) light resistance and has little or no preserving properties. Its role is to help the other chemicals to fix in the wood, binding them through chemical complexes to the wood's cellulose and lignin. It should be mentioned that even if CCA treatment is presently prohibited for residential uses, some CCA treated woods are still in service. Moreover, CCA products are still permitted for use in various industrial and public works, such as bridges, highway safety fencing, electric power transmission and telecommunications poles (FCBA, 2011). Thus, this kind of preservatives continues to be of concern to the environment.

The Copper Azole is a fungicide and an insecticide. There are two types of Copper Azole: type A (CBA-A), and type B (CA-B). Copper Boron Azole type A contains the following ingredients: copper (49%), boron as boric acid (49%), and azole as tebuconazole (2%).

Copper Azole type B is composed of copper (96.1%) and azole as tebuconazole (3.9%) (EPA, 2011). Some of the commercial CBA contain also glycol (US -DOI, 2011). Despite research efforts, no effective means has yet been found to keep borate preservatives from leaching out of wet wood (US-DOI, 2011).

The Ammoniacal Copper Quaternary (ACQ) contains copper, as fungicide and a quaternary ammonium compound as insecticide. There are currently four AWPA standardized ACQ formulations (types A to D). All ACQ types contain the 2 active ingredients which may vary within the following limits: copper oxide (62%-71%) and a quaternary ammonium compound (29%-38%). The ACQ is considered as an alternative to CCA treatment. Nevertheless, because of its higher level of copper, ACQ-treated wood is more corrosive to common steel and the use of double-galvanized or stainless steel fasteners is necessary for this kind of treated wood processing (US-DOI, 2011).

The Cu-HDO is composed of copper and N-cyclohexyl-diazeniumdioxide (HDO). Cu-HDO affects sulfhydryl groups of essential amino acids of fungi and cause protein denaturation (EPA, 2011). It is classified as moderately hazardous (toxicity class II, with a LD50 of 380 mg/kg) (WHO, 2006).

Borate preservatives such as boric acid, oxides and salts (borates) are supplied under numerous brand names throughout the world. Borate treated wood is considered of low toxicity (toxicity class U -see Table 1). However, borate compounds do not become fixed in the wood and can readily be leached out. They are efficient rather for use class 1 and 2 (see § 7.2.3), such as framing, sheathing, sill plates, furring strips, trusses and joists (EPA, 2011).

Oil-borne preservatives include creosote and some vegetal oils containing permethrin.

Creosote is one of the oldest wood preservatives. Because of the content in known carcinogenic chemicals, it was restricted or prohibited (JORF, 1992;EC, 2001). However it is still used for railroad ties and utility poles. In recent years linseed oil has been incorporated in preservative formulations as a solvent and water repellent together with low water solubility preservatives, such as Permethrin. Permethrin is a broad spectrum non-systemic synthetic pyrethroid insecticide [START_REF] Imgrund | Environmental Fate of Permethrin[END_REF].

Light organic solvent preservatives (LOSP) are based on the use of white spirit, or light oils such as kerosene, as solvent carrier for biocides. Synthetic pyrethroids are typically used as an insecticide, such as permethrin, bifenthrin or deltamethrin. Other actives compounds are the Propiconazole and Tebuconazole as fungicides. These kinds of preservatives contain no heavy-metal compounds but they are still of concern for health and environmental impacts, due to the release of the volatile organic compounds (VOC) and of the organic biocides.

For few years now, preservatives containing micro or nano-sized copper particles are used for wood treatment. There are currently two particulate copper systems on the market. One system uses a quaternary biocide system (known as MCQ) and is based on ACQ. The other uses an azole biocide (known as MCA or μCA-C) and is based on Copper Azole. This kind of preservatives raised concerns regarding exposure to micron and nano-sized particles, in the context of the general debate about the nanotechnology hazard to humans and environment [START_REF] Evans | Large-scale application of nanotechnology for wood protection[END_REF][START_REF] Matsunaga | Microdistribution of copper-carbonate and iron oxide nanoparticles in treated wood[END_REF][START_REF] Matsunaga | Copper nanoparticles in southern pine wood treated with a micronized preservative: Can nanoparticles penetrate the cell walls of tracheids and ray parenchyma?[END_REF]ICTA, 2010).

The wood chemistry with respect to interactions with the biocides

The wood material is composed of mainly three biopolymers present in different proportions, namely cellulose (about 45% in weight), hemicellulose (about 30%) and lignin (20%) and a small fraction (about 5%) of low weight compounds extractible in water or other solvents, named extractives [START_REF] Govin | Aspects physico-chimique de l'interaction bois -ciment -Modification de l'hydratation du ciment par le bois[END_REF].

Cellulose is composed of linear chains of D-glucose linked by ß-1,4-glycosidic bonds with a degree of polymerization of about 10000. Cellulosed possesses hydroxyl groups and has the specific reactivity of primary and secondary alcohols (donor reactivity of hydroxyl groups).

Hemicelluloses are heteropolysacharides (containing glucose, galactose, xylose, arabinose, mannose, acides uroniques) with lower polymerization degree (50-300) and amorphous structure. The chemical structure of hemicellulose varies form soft to hard wood. It contains mainly hydroxyl groups but also carboxylic groups. The lignin is a complex network of polymers (molar mass that exceeds 10000) composed of phenolpropane units and containing characteristic methoxyl groups, phenolic hydroxyl groups and some terminal aldehyde groups. Lignin is associated with hemicellulose forming complexes that are resistant to hydrolysis. There is no evidence that lignin is associated with cellulose. Other minor polysaccharides present in wood are pectines, starch and proteins.

The low weight compounds are organics belonging to many chemical classes: fats, fatty acids, fatty alcohols, phenols, terpenes, polyphenols, tannins, lignans (combination of 2 phenylpropane units), steroids, resin acids, rosin, waxes, etc. Wood contains also inorganic species represented by silica, and several major elements Ca, Mg, K (up to 80% of the ash).

These metals are probably bound to carboxyl groups in pectic materials, oxalates, carbonates, sulfates. Many other metals are present in lower quantity.

Wood is slightly acid material heaving pH values in contact with water in the range of 3 to 6, depending on wood species (e.g. pH 3 for the Western Red Cedar and pH 6 for the Ash tree).

The acid/base properties and general reactivity of wood materials are determined by the functional groups linked to the polymeric structure. So, carboxyl groups are attached mainly to hemicelluloses and pectins and have acidity constants pKa values between 3 and 5. Lignin contains phenolic groups (pKa = 7.5-10.5) and small quantities of carboxyl as a result of oxidation processes. The acid/base properties of wood extractives in water is due mainly to carboxyl groups (pKa of 5.0-6.5) and their solubility rises with the temperature and alkali content [START_REF] Balaban | The correlation of wood acidity to its solubility by hot water and alkali[END_REF]Ravat et al, 2000a;[START_REF] Duong | Extension of Donnan theory to predict calcium ion exchange on phenolic hydroxyl sites of unbleached kraft fibers[END_REF].

Complexation and ion exchange are the two main interaction mechanisms of metal ions with wood components. The ion exchange mechanism is possible at the level of carboxyl functional groups present in hemicellulose, pectins or lignin. It manly concerns alkaline and alkaline-earth cations and is a non-specific electrostatic interaction. The heavy metals (like Cu, Cd, Ni, Zn, Pb) are mainly concerned by reactions of surface complexation with the functional groups phenol and carboxyl. The phenolic sites lying on lignin have significantly higher affinity for transition metals than the carboxylic sites. The conclusion of many studies is that cellulose has a lower sorption capacity for heavy metals compared to lignin. The extent of metal sorption depends on pH and aqueous ionic strength. Complexation constants for several heavy metals including Cu and Zn are reported in the literature (Ravat et al., 2000a;[START_REF] Merdy | Copper Sorption on a Straw Lignin: Experiments and EPR Characterization[END_REF][START_REF] Guo | Adsorption of metal ions on lignin[END_REF]Ravat et al., 2000b).

In the system wood/water, at low pH, the metals exist predominantly as free cations in solution. When the pH increases, the deprotonated carboxylic sites contribute significantly to their fixation by forming complexes. At higher pH, phenolic sites become deprotonated and participate to metal binding. These complexes are in majority monodentate S1-O-M+, and in a lesser extent bidentate S1-O-M-O-S2 (here S1, S2 are organic functional groups, M is a bivalent metal). The proportion of the aqueous metal species and fixed complexes on biopolymers depends on pH and ionic strength, and can also be influenced by the presence of extractives.

The maximum metal quantity a wood material can fix by specific interactions is given by the number of binding sites. The site density depends on the wood species and biopolymer type.

As for example, a lignin isolated from black liquor (a residue of paper industry) [START_REF] Guo | Adsorption of metal ions on lignin[END_REF] contains about 0.08 mmol carboxyl and 0.28 mmol phenolic groups per g of dried wood. A hemicellulose extracted from cotton wood [START_REF] Degroot | Preliminary investigation of the association of inorganic cations with carboxylic acid groups in wood[END_REF] contains about 0.08 mmol/g carboxyl groups.

The extractives are organic compounds able to undergo complexation reactions with free metals present in aqueous solution (by intermediary of carboxylic, phenolic groups, or other electron donor groups). Copper is particularly renowned for its capacity to complexate with dissolved organic matter, resulting in an increase of its global leachability.

In aqueous phase chromium behaves as Cr(III) and Cr(VI).In contact with biomaterials like wood, Cr(VI) transforms into Cr(III) by an adsorption-coupled reduction mechanism involving adsorption steps of both species and reduction of Cr(VI) such that Cr(III) becomes dominant in the system [START_REF] Dupont | Removal of Hexavalent Chromium with a Lignocellulosic Substrate Extracted from Wheat Bran[END_REF][START_REF] Park | Reliable evidences that the removal mechanism of hexavalent chromium by natural biomaterials is adsorption-coupled reduction[END_REF].

According to [START_REF] Bernardo | Chromium (III) uptake by agro-waste biosorbents: Chemical characterization, sorption-desorption studies, and mechanism[END_REF], Cr(III) adsorption on biomaterials follows a reaction path involving phenolic or carboxylic groups leading to mono and polydentate complexes with free and hydroxylated Cr -3 ions. Despite the abundance of literature on the subject [START_REF] Miretzky | Cr(VI) and Cr(III) removal from aqueous solution by raw and modified lignocellulosic materials: A review[END_REF], no intrinsic complexation constants have been determined.

Boron leachability in treated wood is recognised to be high but its chemistry in wood is far from well understood. The most of authors consider that boron doesn't react with wood materials and is completely available for leaching. Other authors consider that B (as boric acid) can form organic complexes via O bridges with hydroxyl groups on polysaccharides [START_REF] Obanda | Reducing leaching of boron-based wood preservatives -A review of research[END_REF][START_REF] Ramos | Boron fixation inwood: studies of fixation nmechanisms using model compounds and maritime pine[END_REF]. No complexation constants are available in the literature.

Generally, the wood preservatives are used as mixture of several chemical substances with complementary biocidal effects. The chemical behaviour of these substances is dependent also on the additives used. Research on products containing ammonia and Cu shown that ammonical copper is readily adsorbed to phenolic hydroxyls, such as found in lignin or extractives. Although, in absence of ammonia, precipitation may occur as copper carbonates, copper oxides, copper arsenate complexes. Also coarse deposits of almost pure copper were observed by spectroscopic investigations localized within the cell wall and on the microfibrils [START_REF] Lebow | Leaching of wood preservative components and their mobility in the environment[END_REF].

However, there is no unanimity concerning the formation of salt precipitates since they are reasonably soluble. Many investigations on CCA treated wood by XAFS (X ray absorption fine structure spectroscopy) indicated that Cu is not chemically associated with any heavy element (Bull, 2001). The results of leaching tests performed with different extractants (acetic acid, EDTA, oxalic acid, etc.) show that Cu is not dependent on Cr and As and exhibits a different release behaviour. The most plausible fixation mechanism for Cu remains the complexation on carboxyl and phenolic sites. Similar mechanisms are possible to occur in the case of Zn, although the binding forces are weaker.

Little information has been published on the fixation mechanism of organic biocides on the wooden materials [START_REF] Woo | Tebuconazole and propiconazole tolerance and possible degradation by Basidiomycetes: A wood-based bioassay[END_REF]. It was observed that these molecules are rather leach resistant suggesting possible interactions with the wood structure. It may be expected that the organic biocides interact with the different wood components at least by weak physical bonds (van der Waals, dipolar and charge transfer interactions) thus adsorbing on the biopolymers.

Their partition between aqueous solution and wood's biopolymers depends on the biocide's hydrophobicity and its aqueous solubility. So, it is expected that hydrophobic molecules have more affinity for lignin than for cellulose. Stronger interactions can occur when biocides possess functional groups able to react with specific sites on wood like hydroxyls (hydrogen bonds).

Investigations [START_REF] Kjellow | Partitioning of organic biocides between wood and supercritical carbon dioxide[END_REF] on tebuconazole, propiconazole and IPBC behaviour during wood impregnation allowed to observe their partition between the carrier solvent and wood samples and leaded to the conclusion that some (adsorption) interactions occur. The adsorption level decreases in order: tebuconazole > propiconazole > IPBC. It was suggested that tebuconazole forms stronger bonds with the hydrophilic biopolymers (hemicellulose for instance) due to the presence of a hydroxyl group.

The exposure conditions of treated wood products

The service life and end life are the longest steps during the life cycle of the treated wood products. Thus, during these two steps the environmental risk could be of more concern.

As function of exposure conditions, Europen Standard EN 335 (CEN, 2006) use class 1 : situation in which the wood-based product is under cover, not exposed to the weather and wetting (exposure to wetting: max 20%), e.g. indoor window frames/sills, doors, floors, etc.;

use class 2 : situation in which the wood-based product is under cover and not exposed to the weather but where high environmental humidity can lead to occasional, but not persistent wetting (exposure to wetting : occasionally > 20%), e.g. some of the indoor window frames/sills, doors, flooring, etc;

use class 3 : situation in which the wood-based product is not under cover and not in contact with the ground. It is either continually exposed to the weather or is protected from the weather but subject to wetting (exposure to wetting: occasionally or frequently > 20%), e.g. roofing, weatherboarding, facade cladding, outdoor window frames/sills and doors;

use class 4 : situation in which the wood-based product is in contact with the ground or fresh water and thus is permanently exposed to wetting (exposure to wetting : predominantly or permanently > 20%), e.g. terraces, decks, play-ground equipment, garden furniture;

use class 5 : situation in which the wood-based product is permanently exposed to salt water (exposure to wetting : permanently > 20%), e.g. decks, marine constructions, ship-decking.

Use class 1 and 2 are of concern mainly for the health impact via the indoor air emissions of eventual VOC contained in the treated wood, whereas the use class 3 to 5 are of concern for the environmental impact, especially via leaching phenomena.

During the service life, the biocide amount in wood products lessens following air emission, leaching and biodegradation processes. Nevertheless, the end of life management (incineration, recycling, landfilling) must take into account the presence of specific toxic substances.

The landfill disposal is allowed for wood wastes whose composition complies with the admission standards in different landfill categories. The biocide release in these systems will affect the landfill leachate composition and thus its management.

Biotransformation of organic compounds by using adapted leaving species (fungi, bacteria) could be envisaged before the entrance of wood residues back in the carbon cycle [START_REF] Woo | Tebuconazole and propiconazole tolerance and possible degradation by Basidiomycetes: A wood-based bioassay[END_REF] by incineration.

Recent research (Tame et al., 2007) found that the presence of Cu-based biocides favours dioxin formation during the combustion of treated wood. The explanation resides mainly in the catalytic activity of Cu for dioxin formation, the smouldering of wood char by the metals providing a favourable temperature environment and the presence of chlorinated organic biocides as precursors for dioxin formation.

Potential toxic effect and ways it can be assessed

As water exposure of treated wood represents the main route for toxic biocides emission in environment, this chapter is dedicated to the mechanisms and methodologies for assessing the toxic effect via leaching processes. The extent of biocide release from treated wood in contact with water is a crucial parameter determining the hazardous effect on human health and on other leaving organisms.

Release mechanisms and parameters of influence

The biocide release from treated wood products is the result of coupled chemical reactions, transport processes and biological activity.

In contact with water, wood material undergoes chemical and structural changes, soluble compounds as natural mineral salts and extractives are released. Fixed biocides are partially desorbed following the thermodynamic equilibrium. All these chemical reactions are influenced by the pH. The natural pH of wood is often acidic so, the contact with neutral water could cause chemical and structural modifications of the wooden material (hydrolysis, deprotonation of acidic functions, dissolution/precipitation of extractives, etc.). pH strongly influences the mineral biocides (Cu, Cr, As, B) binding by complexation reactions on carboxyl and phenol groups, but also the interaction between hydrophilic organic compounds.

The presence of oxygen is a factor of wood ageing by oxidation of, for examples, phenol groups and depolymerisation of lignin.

Besides chemical processes, the organic natural compounds and biocides can be transformed by biological activity of bacteria or fungi. The decay period of organic biocides is variable as well as the secondary compounds formed, following the surrounding conditions.

Wood is a porous, hygroscopic material, all the processes mentioned above take place in the porous structure. There are gradients of composition between the core and the product surface following water contact conditions the product undergoes. The dynamics of the biocide release from a given wood piece is then determined by the diffusion processes in the porous structure. Wood is an anisotropic material; the diffusion rate varies following the orientation: it is maximal along the fibres, minimal in tangential and intermediary in radial direction.

Once the biocides reach the external surface of the wood piece, their dispersion in the environment is ensured by the water circulation in soils, surface and ground waters, potentially affecting the quality of environmental compartments (including water resources for human consumption) and the integrity of living targets. In some cases attenuation could occur through soil infiltration by chemical (retention, decay) and biological (degradation) mechanisms. Dispersion of the released pollutants into surrounding water and soils plays a diluting role of the initial leachate.

Numerous leaching studies have been realized at laboratory or field scales for determining the biocide release from wood products [START_REF] Cooper | Leaching of CCA from treated wood-pH effects[END_REF][START_REF] Lebow | Leaching of wood preservative components and their mobility in the environment[END_REF][START_REF] Brooks | Literature Review and Assessment of the Environmental Risks Associated with the Use of CCA Treated Wood Products in Aquatic Environments[END_REF][START_REF] Hingston | Leaching of chromated copper arsenate wood preservatives: a review[END_REF]Solo-Gabriele, 2003;etc.) and highlighted the role of different influence parameters, described here below.

1) The nature of preservation product and treatment process used. The chemical nature of biocide compounds and accompanying additives are determinant, as discussed in paragraph 7.2. The method used for incorporating biocides in wood could modify the porous structure (effect of pressure or chemical reactions) and the speciation of metals at the beginning of the service life. Precipitations after wood drying can occur followed by subsequent redistribution of metals between the wood polymers, pore solution and mineral salts. A long period between treatment and immersion in water allows a more effective biocide fixation and lessen the release magnitude.

2) The geometry of wood products and type of water contact. A great specific external surface (low size pieces) enhances the mass transfer process and then the leaching rates. Water contact is an important factor: intermittent or continuous, stagnant or flowing -the total extracted amount depends on the cumulated liquid/solid ratio and the water residence time.

The aqueous leachant can have various compositions following the exposure scenario: fresh, rain, sea waters or soil water, containing salts, natural organic matter, dissolved gases, in different proportions and affecting the wood's and biocides' chemistry at different extents (for example, Cu leaching is favoured by the presence of dissolved organic matter). The exposure time results in a more or less released quantity; the leaching is more intensive at the beginning of the exposure scenario and slows with the product ageing.

3) The exposure climate conditions. Rain events determine the water contact type and parameters (discussed here above). A temperature increase can accelerate chemical reactions and biologic activity. UV radiation and oxygen contribute to degradation by breaking and oxidation of wood polymers and thus enhance the release [START_REF] Schiopu | Caractérisation des émissions dans l'eau des produits de construction pendant leur vie en oeuvre[END_REF].

Methodologies of toxic effect assessment

Biocides are intrinsically toxic substances and the harmful effect will strongly depend on their release behaviour.

The extrapolation of partial field observations or laboratory assays to conditions encountered in real scenarios of service life is not obvious. The assessment of toxic effects needs comprehensive methodologies and adapted experimental and modelling tools, these requirements being the reason for the European authorities endeavour to develop standard assessment methods.

The assessment of the potential harmful effects of biocides released in a given scenario of wood product utilization can be realized following classical methodologies of risk assessment on ecosystems and human health. These methodologies consist on the evaluation of three components of the cause-effect chain: the source of pollution (the wood product for instance), the pollutant transport through environmental compartments (soils, waters) and the effects on living targets. A sound evaluation of the physico-chemical and biological processes at the level of these three terms is necessary and possible by using appropriate experiments, models and data bases. A more detailed description is given in chapter 15 of this book.

The hazardous effect of biocides as toxic molecules present in different environmental compartments is evaluated by bioassays (toxicity tests) on selected species, then the risk is evaluated by comparing the test results with toxicological parameters (lethal or effect doses and concentration).

The key point in the assessment process is the evaluation of the exposure of living targets to a biocide, i.e. the knowledge of the biocide concentration and its time evolution, the released flux from the wood product. So, the knowledge of the wood product behaviour in its utilization scenario (the source term of pollution) is fundamental for the evaluation of the exposure conditions. The most common experimental tools for studying the leaching phenomenon are the leaching tests. Some of these tests (i.e. static leaching tests) give information about different intrinsic properties of the material (e.g. acid/base neutralisation capacity, pH influence on pollutant release) and others (i.e. dynamic leaching tests) provide knowledge about the release dynamics -see also chapter 15 of this book.

As mentioned above, the leaching of biocides from construction materials is a research subject receiving attention from the European regulation authorities. The main standards concerning the leaching behaviour, presently under development are : CEN/TC 351/WG 1 N 178 -Generic horizontal dynamic surface leaching test (DSLT) for determination of surface dependent release of substances from monolithic or plate-like or sheet-like construction products ; CEN/TC 351/WG 1 N 177-Guidance standard for CEN Product TCs for selection of leaching tests appropriate for their product(s) -General principles and CEN/TC 351/WG 1 N 162 -Generic horizontal up-flow percolation test for determination of the release of substances from granular construction products (CEN, 2011). Up to these protocols, at the European level two standards referred to the leaching of wood preservatives: the XP ENV 1250-2 (CEN, 1994) and the EN 84 (CEN, 1997). The XP ENV 1250-2 specifies that 'the results cannot be connected to the conditions of exposure in the service life of wood based products, as part of the building'. The EN 84 aims the accelerated ageing of treated wood prior to biological testing. These two standards are rather tests that aim to evaluate the effectiveness of the wood preservation treatment and not the environmental impact due to the biocides leaching.

A lot of works have been performed aiming at the leaching process characterisation, at different scales and following different experimental protocols. As mentioned above, we distinguish between two types of leaching assays: 1) equilibrium tests -the wood material (generally of very small size, crushed) is put in contact with a leachant for a given duration, allowing chemical equilibriums to occur (e.g. batch assays); 2) dynamic tests -processes like diffusion or leachant flow determine the time evolution of the released quantities (e.g. block diffusion, runoff). The results are weakly comparable and generalisation is not possible, especially when transport phenomena play a major role in the release process. For these reasons only few examples are given here; the interested reader may consult the multiple other journal articles.

The biocide solubilisation under different pH conditions was investigated [START_REF] Esser | Harmonization of leaching tests: Leaching behaviour of wood[END_REF][START_REF] Schiopu | Caractérisation des émissions dans l'eau des produits de construction pendant leur vie en oeuvre[END_REF][START_REF] Tiruta-Barna | Modelling inorganic biocide emission from treated wood in water[END_REF] showing similar leaching patterns for the inorganic biocides (Cu, Cr , As, B, Zn). In the case of wood samples treated with CCA and Cu-quat (copper oxide, didecyldimethylammonniumchloride or DDAC) preservatives [START_REF] Esser | Harmonization of leaching tests: Leaching behaviour of wood[END_REF], it was showed that Cu, Cr and As have a maximum fixation at pH 7-8 and the solubilisation augments for many orders of magnitude at acid or alkaline pH. So, for natural pH values of the most wood species (i.e. acid), the element fixation is not optimal (see figure 1 (Tiruta- [START_REF] Tiruta-Barna | Modelling inorganic biocide emission from treated wood in water[END_REF]). The most important variation was observed for Cu, while As behaviour is slightly different following the type of preservative. Complementary, the behaviour of extractives was observed, their global concentration (determined as dissolved organic carbon) augments with the solution alkalinity.

Dynamic tests were performed at lab and field scales [START_REF] Esser | Harmonization of leaching tests: Leaching behaviour of wood[END_REF][START_REF] Schiopu | Caractérisation des émissions dans l'eau des produits de construction pendant leur vie en oeuvre[END_REF][START_REF] Hingston | The importance of the short-term leaching dynamics of wood preservatives[END_REF][START_REF] Hasan | Fieldscale leaching of arsenic, chromium and copper from weathered treated wood[END_REF] and made subject of inter-laboratory studies for the development of leaching assessment methods and leaching tests (Schoknecht et al., 2005).

A comparison was made (see figure 2) between the dynamic release in laboratory leaching tests (MBT sequential renewal of leachate, CMLT continuous renewal) and field assays on a commercial wood product treated with Copper -Boron -Azole based preservatives [START_REF] Schiopu | Caractérisation des émissions dans l'eau des produits de construction pendant leur vie en oeuvre[END_REF][START_REF] Schiopu | Caractérisation des émissions dans l'eau des produits de construction pendant leur vie en oeuvre[END_REF]. The field pilot simulates two scenarios of intermittent rainwater contact: immersion in rain water (stagnation) and run off rain water, during one year (leachates' concentrations and rainfall events were monitored). It was observed that the cumulated release increases for many orders of magnitude with the effective leaching time (the duration of dry periods was not accounted for). More or less significant differences have been observed between the tests, following the target element (Cu: similar releases; Zn: different shapes). During one year of rain exposure, the stagnant scenario accounts for more effective contact time (about 300 days) than the runoff scenario (30 days). The releases' increase in stagnation scenario after 30 days could be explained by a weathered process of the wood samples. Therefore, the release level in this scenario tends to those of an aged wood sample after about 100 days. Despite the literature abundance on studies dedicated to the biocide leaching and wood retention mechanisms, there are few studies which structure the information and knowledge on mechanistic models. The interest of modelling of physic-chemical processes resides in the possibility to confirm hypotheses based on experimental observations, to identify and calculate related parameters, and to foresee the system behaviour for different exposure conditions. Modelling could make interpretation bridges between different observed systems, different scales and resolve unexplained experimental results.

Diffusion transport in the wood porosity is one of the earlier modelling tentative (other than empirical regression equations). Recently, the leaching from wood was modelled [START_REF] Waldron | Modeling of simultaneous three-dimensional leaching and chemical reaction of CCA components in unfixed wood exposed to water[END_REF] by soluble species (no chemical reactions) and their tridimensional diffusion following the wood anisotropy (along fibres, radial and tangential directions).

Diffusion coefficients of 10 -10 -10 -9 m 2 /s have been calculated for the longitudinal direction.

The transport mechanisms are not sufficient for representing the leaching behaviour. The chemistry of wood/biocide system, although very complex, must be formalised and integrated on coupled chemical-transport models. Chemical models are very few in the literature. A realistic chemical model was established [START_REF] Tiruta-Barna | Modelling inorganic biocide emission from treated wood in water[END_REF] for explaining the leaching behaviour of a wood product made on Copper Boron Azole (CBA) treated Pinus Sylvestris. The model considers the main fixation mechanisms for Cu, B and other trace species present in wood (Cr, Zn, Ca, SO4 -2 ). The influence of dissolved organic matter on Cu release was modelled by pH dependent complexation reactions. The model can explain the leaching behaviour in closed system (at equilibrium) for a pH range from 3 to 11 (cf. prCEN/TS 14429 (CEN, 2002)) (figure 1). This kind of models represents steps forward but more efforts are needed to integrate transport and reliable chemical models into useful predictive tools for the leaching behaviour assessment.

Toxicity studies -case examples

Despite the fact that the biocide release issue gains more and more interest, there are few available studies in the literature evaluating the harmful effect or risk for real service life scenarios of commercial products by using standard methodologies and tools.

Ecotoxicological studies were carried out mainly on conventional preservatives using different methods, experimental assays and conditions, and expressing the results in different, often incomparable manners.

The compilation of field observations of biocide release from wood products in their service life [START_REF] Lebow | Leaching of wood preservative components and their mobility in the environment[END_REF][START_REF] Hingston | Leaching of chromated copper arsenate wood preservatives: a review[END_REF] highlighted that the methods and experiments used since many dozens of years vary from a study to another and a coherent analysis of the leaching process and involved mechanisms is very difficult, due to lack of complete information. The most monitored preservatives as far are Cu-based with different compositions: CCA (the most studied), ACA, ACZA, ACQ, DDAC, CC, CuAz. For all study cases the behaviours of Cu, As and Cr were observed in terms of wood residual composition and soil or water concentration.

One of the most studied scenarios is of type 'underground contact' (poles, posts, plywood, stakes) considered as the worst case of biocide emission. The biocide emission and pollution is demonstrated by a higher soil concentration than in the natural background. In these different studies, higher concentrations of about several to 1000 times were measured on the soil volume around the wood product within a radius of about 1 m. The biocide loss by the wood products was of about 10 to 30 % in several years, with various levels for Cu, Cr and As.

In marine environments, the immersed wood products release important quantities of inorganic biocides, as was observed in the majority of reported studies. Biocide concentration depletion of the surface layer of wood samples of 40% to 85% was observed after several years of service life. It was noted that the major part of biocide losses occur in the first weeks of sea water contact. The contamination of the living marine species was demonstrated by measuring the level of Cu, Cr and As in green algae, oysters and crabs collected from the wood sites (including sediments), which has been found to be higher than the natural concentration.

The immersion scenario in fresh water was less studied. Slightly higher concentrations in CCA components were found downstream and depleted biocide concentration was measured in the wood surface layer.

The 'above-ground' contact is considered less harmful because the contact with water is rather intermittent, depending strongly on the surface area exposed to rain.

All the above mentioned studies (based on field measurements of pollutant concentrations) concluded at a non-impact or insignificant effect given the low concentration and the limited dispersion of the target biocides in soils and waters (effects of dilution and natural attenuation), although the toxic effect was not properly assessed.

On the opposite, studies performed on controlled conditions, using leachates from treated wood, with or without dilution, and using various toxicity tests on living organisms have concluded on the possible or effective harmful impact on aquatic compartments and, in a less extent on top-soil organisms. Several case studies and their main findings are presented here.

The toxicity of commercial preservatives (propiconazole, tebuconazole, IPBC, cypermethrin) for aquatic organisms was studied [START_REF] Adam | Mixture toxicity assessment of wood preservative pesticides in the freshwater amphipod Gammarus pulex (L.)[END_REF] using bioassays (freshwater amphipods Gammarus pulex (L.)) and the results obtained for individual biocides shown the toxicity increases from propiconazole to cypermethrin, and that there are synergic effects enhancing the harmful effect of the commercial mixture.

The top-soil ecotoxicity from a contaminated site with wood preservatives Cu-sulphate and CCA was studied [START_REF] Mench | Assessment of Ecotoxicity of Topsoils from a Wood Treatment Site[END_REF] using target organisms (radish, lettuce, slug Arion rufus L., and earthworm Dendrobaena octaedra). The levels of contamination (variables on the site) were of 65 to 2600 mg Cu kg -1 , 0-52 mg As kg -1 and 0-87 mg Cr kg . The results showed a high Cu content in plants and negative effect on plants growth for the most contaminated site. [START_REF] Dubey | Impact of surface water conditions on preservative leaching and aquatic toxicity from treated wood products[END_REF] studied the aquatic toxicity of leachates obtained from blocks of wood treated with Cu based preservatives (CCA, ACQ, CBA). A specific heavy metal toxicity assay was used, based on inhibition of ß-galactosidase activity in an E. coli strain. Natural water compartments were considered (rivers, lakes, wetlands, and seawater) along with synthetic moderate hard water and deionized water. In their study, Cu was released from ACQ-and CBA-treated wood about 10 to 20 times more than from CCA-wood. The toxicity of aquatic compartements was found to correlate with the labile (non complexated) Cu concentration in waters. The bioavailability (and hence the toxic effect) is reduced in the presence of organic and mineral complexes in natural waters.

The new generation preservatives replaced CCA for residential constructions; however, not enough hazard assessment has been performed as far. Furfurylated wood as alternative to CCA-wood, was tested for its aquatic toxicity (Pilgard et al., 2010). Aquatic organisms were used in Microtox and Daphtox, applied to leachates obtained from different treated woods, in two leaching tests. The most relevant results concern the influence of the treatment procedure on the potential toxicity: those processes which favour the curing/polymerisation led to less impacting products. Hemlock stakes treated with different preservatives (e.g. CCA, creosote, ACQ, zinc naphthenate, copper naphthenate) was tested [START_REF] Lalonde | A comparative toxicity assessment of materials used in aquatic construction[END_REF] for the aqueous toxicity, acute lethality tests being performed with Daphnia magna, Vibrio fischeri, rainbow trout and threespine stickleback. For the samples tested, the toxicity varied in the order: ACQ > creosote > zinc naphthenate > copper naphthenate > CCA.

Remedial action

Different remedial actions were imagined in order to replace the biocides use for the wood preservation. The most evident was to use naturally durable species such as red pine (Pinus resinosa), teak (Tectona grandis), merbau (Intsia bijuga), ironbark (Eucalyptus spp.), instead of treated wood. Natural durability consists on the capability of wood to develop selfresistance by the presence of fungitoxic components (mainly the polyphenols) formed by chemical reactions during the transition from living sapwood to dead heartwood. However, there is no evidence of such performance for all the services conditions required by the construction field. Moreover, economical issue (many of these species are prohibitively expensive for general construction applications) and global environmental impacts may restrain this alternative of using treated wood (sometimes they are logged in an unsustainable manner and many of these species grow only in specific area, therefore the environmental impact due to the worldwide transportation is high).

The use of composite materials made of wood fibers and recycled plastics was also proposed as alternative to treated wood. The main advantages are considered the fact that it doesn't warp, split, chip or rot, it requires little maintenance, being resistant to moisture and presents a variety of colours to choose from. Nevertheless, it has some disadvantages: it is not rated for structural use, it is susceptible to mildew, mold and stains and it is also more expensive compared to treated wood (EPA, 2011).

Other alternatives are based on the well known concept that the physical properties of any material are determined by its chemical structure. The degradation of wood is considered to be initiated by enzymes attack at the free hydroxyl sites contained in the wood (Roger et al, 2008). Therefore, in order to make the wood resistant to biologic attacks, the main alternative techniques are based on the sealing or transformation methods of these free hydroxyls.

One of these techniques is the autoclave impregnation with linseed, sunflower or rapeseed oil (without synthetic preservative). The tung oil has been also used for hundreds of years in some countries (without any pressure treatment). The function of these oils as preservatives is related to their action as water repellents and drying agents rather than a direct biocidal activity. Nevertheless, their effectiveness is restricted to some specific applications.

Other method is based on glass encapsulation of the wood fibres. The so called 'glass fortified wood' or 'glass wood' is obtained through a process that intermixes a sodium silicate based formula throughout the wood fibres [START_REF] Flynn | Toxin-free treated wood[END_REF]. The glass wood can be used for in ground contact applications and in water applications.

The modification of wood chemical structure was proposed by acetylation or heat treatments.

The acetylation methods are based on wood reaction with some anhydrides, such as acetic anhydride. Acetylation process changes the free hydroxyls within wood into acetyl groups.

The acetylation of wood was first done in 1928 but the large-scale production of acetylated wood began only in 2007 [START_REF] Rowell | Production of Dimensionally Stable and Decay Resistant Wood Components Based on Acetylation[END_REF].

The heat treatments were recently developed. These processes (e.g. Retification®, Thermowood ®, Plato®, etc.) autoclave the wood subjecting it to pressure and heat (180 to 230 °C), along with nitrogen or water vapour for 24 to 48 hours [START_REF] Yan-Jun | Heat-treated wood and its development in Europe[END_REF]. These processes increase the durability, dimensional stability and hardness of the treated wood.

However, there are changes in aesthetic and certain mechanical characteristics. Wood treated with this process is often used for cladding or siding, flooring, furniture and windows.

Other « compromise » techniques are based on a combined treatment by biocidal products and natural compounds playing the role of water repellents. In addition, these compounds can have a biocidal effect. This method seems to be promising for the leachability reduction of boron based preservatives, as reported by different studies. [START_REF] Temiz | Decay resistance of wood treated with boric acid and tall oil derivates[END_REF] propose the impregnation of boron-treated wood by tall oils in order to avoid the water penetration in wood porous structure. Tall oils are exctractives obtained as by-products of pulp processing of softwood (sulphate method). Their water repellency property is due to the chemical composition (variable following the wood species): 40-55% resin acids, 40-60% fatty acids, 5-10% neutral compounds. Tall oil can protect the boron compounds against leaching allowing the preservation of the wood resistance for more long periods and at the same time, avoiding the release of toxic leachates. Similar effect was reported by [START_REF] Baysal | Amount of leachant and water absorption levels of wood treated with borates and water repellents[END_REF]. In this study, a treatment with polyethylene glycol-400 helped to decrease the water adsorption in wood and an additional water repellent (styrene, methyl methacrylate and isocyanate) treatment diminished the boron leaching. Leaching tests realized in continuous and discontinuous modes on treated wood impregnated with montan wax emulsion clearly showed the reduction of boron leaching for 20% up to 50% [START_REF] Lesar | Montan wax improves performance of boron-based wood preservatives[END_REF]. In another study (Sen et al., 2009) extractives from different plants were tested for their efficiency for wood preservation (by their high tannin content) and for avoiding the preservatives (salts containing B, Cu) leaching from different species of treated wood. The highest effects were seen in wood treated with sumac leaf extract and oak valonia extract, in presence of 1 to 3% of salts.

Conclusion and future trends

The treatment of wood has been practised for almost as long as the use of wood itself.

Different types of preservatives were used, according to the consumers and legislative constraints, imposing increasingly strict conditions concerning both the effectiveness and the innocuousness of the wood treatment.

Concerning the potential hazard of treated wood, the service life and end life are the longest steps during the life cycle of the treated wood products. Thus, during these two steps the environmental risk could be of more concern, via the leaching phenomena of biocides used for the treatment. One could conclude that different experimental protocols co-exist meaning to assess the leaching behaviour of biocides form treated wood. The objectives of these protocols are different. Moreover, the application of an experimental method alone is not sufficient for a pertinent and scientifically sound assessment. A mechanistic modelling approach is necessary. Indeed, the release of wood preservatives and risk assessment for ecosystems is closely linked to the physico-chemical mechanisms induced by wood/water contact. Despite the literature abundance on studies dedicated to the biocide leaching and wood retention mechanisms, there are few studies which structure the information and knowledge on mechanistic models. The interest of modelling of physic-chemical processes resides in the possibility to confirm hypotheses based on experimental observations, to identify and calculate related parameters, and to foresee the system behaviour for different exposure conditions. Modelling could make interpretation bridges between different observed systems, different scales and resolve unexplained experimental results. Also, different remedial actions were imagined in order to replace the biocides use for the wood preservation, such as the use of naturally durable species or the use of the composite materials made of wood fibers and recycled plastics. In order to make the wood resistant to biologic attacks, other alternatives to treated wood are based on the sealing of active sites (free hydroxyls) or the wood chemical structure transformation.

The main issue for the future is to develop more knowledge on the wood chemistry and different treatment mechanisms, in order to help the decision makers to reach equilibrium between the treatment effectiveness, the global environmental and health impacts and the economical costs of the process, on the basis of the global thinking concept.

oo

  Copper as Copper Carbonate, Copper hydroxide, Copper oxychloride, Copper sulphate, Cuprous oxide, Copper Hydroxycarbonate or Copper organic compounds, Boron as Borax, Boric acid or Disodium Octoborate Tetrahydrate (DOT) o Chromium as Chromium Trioxide, Sodium Dichromate, o Arsenic as arsenate in CCA. -Organic (by chemical class): o Azole : Azaconazole, Propiconazole, Tebuconazole, Cyproconazole, Thiabendazole, o Ammonium quaternary compounds : Chlorure de dimethyl alkyl benzylammoniun, Chlorure de dimethyl coco benzyl ammonium, Chlorure de dimethyl didecyl ammonium, Chlorure de trimethyl coco ammonium o Benzoylurea: Noviflumuron, Diflubenzuron, Flufenoxuron, Hexaflumuron, o Benzimidazole : Carbendazim, o Carbamates : Copper dimethyldithiocarbamate (CDDC), I.P.B.C.( 3-iodo-2propynyl-n-butyl carbamate), Fenoxycarb, o Diazenium-compounds: Bis-(N-cyclohexyldiazeniumdioxy)-copper (CuHDO), o Isothiazolone : DCOIT (4,5-dichloro-2-n-octyl-3(2H)-isothiazolone), o Morpholine : Fenpropimorph, o Neonicotinoids: Thiamethoxam, o Organophosphorus : Chlorpyrifos, o Pyrazole : Chlorfenapyr, Fipronil, o Pyrethroid: Cypermethrin, Permethrin, Bifenthrin, Cyfluthrin, Deltamethrin.

  defines five use classes which represent different service situations to which wood-based products can be exposed. The classes described in the Europen Standard are based on an existing classification agreed on by the European Homologation Committee (EHC), after taking into account the possibility of harmonisation with three moisture categories of Eurocode 5 and with other classes used outside Europe. It has, however, been judged that the following five classes are the most appropriate solution for European conditions:

  Bull, D.C. (2001), The chemistry of chromated copper arsenate II. Preservative-wood interactions, Wood Science and Technology, 34, 459-466. CEN -European Committee for Standardization (2006), EN 335 Durability of wood and wood-based products -Definition of use classes -Part 1: General, Brussels. CEN -European Committee for Standardization (2002), prCEN/TS 14429 Caractérisation des déchets. Influence du pH sur l'émission de constituants inorganiques par les déchets, avec addition de quantités prédéfinies d'acide -base destinées à des états stationnaires, Brussels. CEN -European Committee for Standardization (1994), XP ENV 1250-2 -Produits de préservation du bois -Mesurage des pertes de matières activés et d'autres composants du produit de préservation à partir de bois traité -Partie 2 : méthode de laboratoire pour obtenir des échantillons pour analyse pour mesurer les pertes après délavage à l'eau ou à l'eau de mer synthétique, Brussels. CEN -European Committee for Standardization (1997), EN 84 -Produits de préservation du bois -Epreuves de vieillissement accéléré des bois traités avant essais biologiques. Epreuve de délavage, Brussels. CEN -European Committee for Standardization (2007), prCEN/TS 15119-1. Durability of wood and wood-based products -Determination of emissions from preservative treated wood to the environment -Part 1: Wood held in the storage yard after treatment and wooden

 Schiopu, N., Jayr, E., Méhu, J., Barna, L., Moszkowicz, P. (2007), Horizontal environmental assessment of building products in relation to the construction products directive (CPD),Waste Management, 27(10), 1436-1443. Schiopu, N., Jayr, E., Méhu, J., Moszkowicz, P. (2011), Assessment of dangerous substances release from construction products to environment. In: Gökçekus H., Türker U., Lamoreaux,


Theodor Schnitzler

Markus Dürmuth
email: markus.duermuth@rub.de

Christina Pöpper
email: christina.poepper@nyu.edu

Towards Contractual Agreements for Revocation of Online Data

Once personal data is published online, it is out of the control of the user and can be a threat to users' privacy. Retroactively deleting data after it has been published is notoriously unreliable due to the distributed and open nature of the Internet. Cryptographic approaches implementing data revocation address this problem, but have serious limitations when considering practical deployment, and they have not been broadly adopted. In this paper, we tackle the problem of data revocation from a different perspective by examining how contractual agreements can be applied to create incentives for providers to conform to expiration regulations. Specifically, we propose a protocol to automate the handling of data revocation. We have implemented a prototype smart contract on a local Ethereum blockchain to demonstrate the feasibility of our approach. Our approach has distinct advantages over existing proposals: It can deal with a wide spectrum of revocation conditions, it can be applied retroactively after data has been published, and it does not require additional effort for users accessing the published data. It thus constitutes an interesting, novel approach to data revocation.

Introduction

Cloud infrastructures and cheap storage are changing how we handle and share data and how long-lasting data becomes. While promising opportunities go along with this storage and access to data, concerns about the negative impact on ever available data and resources arise. As more and more personal information is shared online, the concepts of digital forgetting [START_REF] Mayer-Schönberger | Delete: The Virtue of Forgetting in the Digital Age[END_REF] and revocation of online data [START_REF] Shein | Ephemeral Data[END_REF] become increasingly important for protecting our online privacy.

From the jurisdictional and also regulatory perspective, the European Parliament has approved the General Data Protection Regulation (GDPR) [START_REF]European Parliament: Regulation (EU) 2016/679 (General Data Protection Regulation)[END_REF] on the protection of natural persons with regard to the processing of their personal data and on the free movement of such data. This Right to be Forgotten [START_REF]European Union: Factsheet on the "Right to be Forgotten" Ruling (C-131/12)[END_REF] already received considerable attention in 2014 due to a ruling by the European Court of Justice (ECJ) [START_REF][END_REF]. The ECJ determined that online search engines need to provide an interface and procedures for EU citizens to request the removal of their personal information from search results.

Technical approaches to implement the Right to be Forgotten apply cryptographic erasure, i. e., publishing data only in encrypted form and making it irretrievable after expiration by a suitable key management [START_REF] Castelluccia | EphPub: Toward Robust Ephemeral Publishing[END_REF][START_REF] Geambasu | Vanish: Increasing Data Privacy with Self-Destructing Data[END_REF][START_REF] Perlman | The Ephemerizer: Making Data Disappear[END_REF][START_REF] Pöpper | Keeping data secret under full compromise using porter devices[END_REF][START_REF] Reimann | Timed Revocation of User Data: Long Expiration Times from Existing Infrastructure[END_REF]. In this work, we explore a mechanism for the revocation of online data that does not purely limit the availability of data in technical terms but provides monetary incentives such that providers take appropriate measures to support data revocation and to comply with expiration conditions. In particular, we propose to conduct an agreement between a user, who owns a specific data item, and a platform provider, who offers access to the data. The agreement defines the expiration conditions for the data items. In contrast to existing approaches, our technique can be applied not only for data at the point of publishing but also for data that has already been made available in the past. Technically, we explore how smart contracts, as available in certain cryptocurrencies such as Ethereum [START_REF] Buterin | A Next-generation Smart Contract and Decentralized Application Platform[END_REF], can be used to realize agreements between users and providers. Compared to other forms of reaching formal agreements, e. g., digitally signed PDFs, smart contracts allow a high degree of automation. Using a distributed ledger system is attractive, as it comprises a trusted third party in a decentralized manner. Our approach is designed to handle the majority of agreements on data expiration. Violations and disagreements in particular cases can still be handled in the jurisdictional system. Data owners might even refer to the contract as a piece of evidence in a potential legal action.

We assume that services featuring a revocation mechanism can also be attractive from the provider's perspective. The broader adoption of services such as Snapchat [START_REF]Snapchat[END_REF] and Signal [START_REF]Whisper Systems: Signal[END_REF] over several years shows that there is a demand for online interaction granting a certain level of privacy.

In short, this paper makes the following contributions: -We design a data revocation scheme based on contractual agreements that can be applied both to new data and to data that has been published in the past. Users can take action both during the lifetime of data and after its intended expiration. To the best of our knowledge, this is the first approach to cover all these aspects at the same time. -Our proposal is particularly efficient for fast data access without unnecessarily burdening users legitimately reading the published data. -We provide an extensive overview of the design space of solutions for the revocation of online data based on cryptocurrencies and contractual agreements. -We provide insights into an instantiation of our protocol: We have implemented a prototype as an Ethereum smart contract to demonstrate the general feasibility of our approach.

Solution Overview

We will now provide an overview of the basic ideas of our approach, before giving detailed insights into our protocol in Section 3.

There are three main entities in the system: the user U , who initially holds and owns the data and wants to publish it online. The data should be published Fig. 1. Timeline of our approach. User and provider conclude the agreement at the time of publishing or later. During its lifetime, the data is freely accessible on the provider's platform. A successful access after expiration leads to a settlement process.

with a provider P , who makes it publicly available on a large online platform in the W W W , such as a social network, or image sharing website.

Whereas previous work has tried to enforce automatic deletion of data, we pursue an idea where both the user and the provider establish a contractual agreement. This agreement states that P will take measures to limit the distribution of the data (e. g., by enforcing a limited lifetime on the data) and that U is entitled to compensation if the provider violates this agreement.

For this process, we distinguish the following four actions: (1) registering the agreement, (2) publishing the data, and (3) probing if the data is still available. When a violation is recognized we (4) enter a settlement process. We illustrate the chronology of these actions in Figure 1.

(1) First, the user and the provider need to reach a formal agreement. This agreement will include (i) the data d it concerns, by means of a unique identifier, (ii) the expiration condition on which the data should become unavailable, e. g., after a specific time t or an event e, and (iii) the penalty p for the provider in case the agreement is violated by the data being available after time t or event e. Similar agreements can be reached in the form of a traditional contract, but enforcing such agreements incorporating very small penalties, e. g., in the range of a few cents, is prohibitively expensive. (2) The actual publishing of data typically involves sending the data to the provider, who will make it publicly accessible. One interesting property of this approach is that Steps (1) and ( 2) can be initiated in arbitrary order. In other words, it is also possible to reach such an agreement even after the data was published. While most other approaches require deciding on using protective measures and even fixing specific parameters such as the expiration time upon publishing, our system can also be invoked retroactively. (3) After publishing and before expiration by meeting the expiration time t or the event e, the data is freely available. Accessing the data requires no additional tools or measures. The user can easily probe whether the data is still accessible before and after expiration.

(4) If the user detects a violation, i. e., the provider fails to handle the data correctly in making it available other than specified in the initial agreement, a penalty mechanism is triggered. A typical settlement could be a small financial compensation.

Adversary Model

The security notion for data revocation considered in previous works is security against a retrospective attacker : Basically, the retrospective adversary becomes active only after the data has been revoked. The attacker should not be able to reconstruct the original data after the expiration. This strong notion can typically only be achieved when the users are entirely honest and refrain from re-uploading the accessed data without protection to a different location. One can argue that re-uploading the data while still available constitutes an explicit act of archiving, in which case the data should indeed be available over time [START_REF] Mayer-Schönberger | Delete: The Virtue of Forgetting in the Digital Age[END_REF]. Additional aspects consider how the protocol can be exploited by the participants to obtain an advantage over the opposite party. The use of financial compensations might tempt the user to claim violations in cases in which the provider complied with the agreement. The provider is therefore interested in a guarantee that the data have actually been accessible at the time of the claim. At the same time upon violation claim, the provider might be interested in false statements, i. e., contending that the data do not exist. Thus, the user is interested in a decision finding that can objectively determine whether the data exists and that is resilient to a provider tampering with it.

Revocation Contract Scheme

We use Ethereum smart contracts [START_REF] Buterin | A Next-generation Smart Contract and Decentralized Application Platform[END_REF] as a convenient method to specify and validate agreements between the data owner and the service provider on the expiration of data. However, Ethereum smart contracts comprise certain limitations, such as accessing data outside the blockchain and strictly enforcing payments between parties. For the specification of our protocol, we therefore require (i) the presence of a data feed for accessing external data and (ii) that a fraction of a potential penalty is placed as a deposit in the contract. The interactions in the stages of our protocol are illustrated in Figure 2.

1+2) Registration

The registration process incorporates the first two steps as proposed in Section 2, since publishing data is a key subject of the agreement registration. A user U can publish a data item d along with an associated expiration condition exp d on the platform of the provider P and will receive an identifier id d for the data from the provider.

The user, who is identified by the address addr U , can then initiate a transaction invoking the registration function of the smart contract C, passing id d and exp d to the contract. The registration process is finalized as soon as the provider also invokes the contract, providing id d , exp d and addr U . Along with the confirmation transaction, the provider places a deposit in the contract, from which a potential penalty can be paid out. We assume that the deposit can be significantly smaller than the prospective penalty, obviously separated for each provider since we expect that contract violations and the resulting settlement processes will only occur in exceptional cases. Deposits are not bound to specific data items, but instead, the contract balance should cover penalties for a certain proportion of all data registered in the contract. In practice there is no fixed order for the last two steps, i. e., it is also possible that the provider is the first party to pass the registration information to the smart contract.

During the registration process, the contract may check the conditions for general plausibility. In case the expiration condition is, e. g., a time t, it should be checked whether t lies in the future. The registration process does not necessarily have to be completed immediately after the publication of the data. It can generally be initiated at any time after the data has been published on the provider's platform.

3) Access Probing After its publication, the data is freely accessible on the provider's platform. There is no need to encrypt the data prior to legitimately reading it during its lifetime. In addition, the owner can probe access in direct interaction with the provider without the contract being involved. We can also delegate this task to a third party, e. g., the owner can assign the task of access probing to a trusted service. This requires that the data is publicly available during its lifetime -our scheme does not cover non-public data.

4) Violation Settlement

Ideally, the provider would have revoked the data according to the expiration condition specified in the contract. Nonetheless, if the owner detects that the data is yet available, a transaction can be initiated to notify the smart contract about the violation, passing the corresponding identifier along with the function call. Violations can be reported not only by the user but by everyone who has access to the data. Thus, the user can even conclude out-of-band agreements at will with dedicated services to check the availability. These services regularly observe the provider's compliance with the contract and initiate settlement on behalf of the user in the case of a contract violation. When the contract receives such a violation claim, it must be checked whether the data is available online. Therefore, the smart contract will request an external data feed service S to retrieve the data from the platform of the provider. Finally, S will initiate a transaction notifying the smart contract that the access attempt has been successful and will provide a hash h(d) of the retrieved data. As the last of the violation settlement, the smart contract will pay out the penalty to the user and a small fee to reward the data feed service for taking part in the protocol.

Protocol Design Space

Next, we sketch how extensions of our protocol and alternatives in its design influence specific properties of the protocol.

Data Identification

In a basic approach, identifiers assigned by the providers are stored in the smart contract for data identification. Usually, this identifier does not change during the lifetime of data, regardless where it is referenced. To improve user privacy, the identifier should not be stored in plain text, but in a cryptographically secure hashed form. However, uploading the data to an external website or even under a new identifier is sufficient to circumvent the protection.

Alternatively, data can be identified using hashes of the original data. Robust hashes [START_REF] Venkatesan | Robust Image Hashing[END_REF][START_REF] Yang | Block Mean Value Based Image Perceptual Hashing[END_REF] are indented to tolerate minor modifications of data, such as rescaling, compression artifacts, and similar in the case of images. The use of such alternative identifiers is generally feasible within our proposed protocol, it only requires the location information as additional input in the first step of the settlement process.

Such extensions appear more desirable for the user, but put a significantly stronger burden on the provider. Location-independent data identification raises additional challenges with regard to the accountability of contract violations. Moreover, by storing images while they are available and re-uploading them at a later point, a malicious user may be able to force compensation payments by the provider, even though the provider has behaved correctly. However, users are not entirely protected from malicious providers or third parties. If the script is transparently available, an adversary can gradually introduce slight changes into the data until they are classified as different to circumvent protection.

Data Feeds

Our system requires the presence of a data feed to incorporate real-world events from outside the blockchain. However, the actual request processing, contacting external resources such as a website, raises concerns regarding the trust required in these services and challenges in validating the delivered results.

First, the response delivered by the data feed should be correct, i. e., the data feed should process the data as they are present at the time of the request. Such a response must be time-bound, because it is not sufficient to show that the data under consideration have existed on the website at any point in time before. Second, transactions performed on the blockchain are publicly visible and irrevocable. The data feed cannot simply access a website and write its contents (i. e., the data) to the blockchain, as this is effectively opposed to the goals of data revocation. We require the data feed to access the data from the provider website, perform an additional step such as determining whether the retrieved data comprise an image, and write the result to the blockchain.

Oraclize [START_REF] Oraclize | Oraclize -Blockchain Oracle Service, Enabling Data-Rich Smart Contracts[END_REF] and Town Crier [START_REF] Zhang | Town Crier: An Authenticated Data Feed for Smart Contracts[END_REF] both use cryptographic means such as TLS Notary Proofs or Software Guard Extensions (SGX) to deliver a proof that certain data exist on a source website. From the perspective of the provider, such cryptographic attestations are attractive to prevent spurious claims from adversarial users. However, the use of a single service appears to be susceptible to malicious providers, as they could identify a particular data feed and deliver false responses to them to avoid the settlement process.

The concept of ChainLink [START_REF] Ellis | ChainLink -A Decentralized Oracle Network[END_REF] comprises multiple data feeds that access data independently from each other and are capable of performing computations on the retrieved data before responding. Its consensus mechanism for aggregating a result from the distributed responses (which can be built on trusted hardware such as SGX on an individual basis) reduces the trust required in the individual data feeds. Moreover, the use of a reputation mechanism that records false responses and a deposit-based penalty mechanism incentivize data feeds to deliver true responses. We imagine this as a crowd-sourcing approach in which even end-users can serve as verifiers in individual cases. Thus, massive misbehaving from the provider appears impossible, which ensures a high level of availability for such a system.

Complex Revocation Conditions

While the majority of prior work on data revocation simply use time-based expiration mechanisms, we suppose that smart contracts can be used to create almost arbitrary expiration conditions. However, these conditions need to be objectively observable through reliable data sources providing appropriate interfaces. Such scenarios would require an additional step in the verification step of our protocol, whereas the general procedure would be similar and security requirements would not be stricter than for the data access verification.

In a naïve approach, the expiration condition is represented as an expression in natural language. There is a need for reliable information sources that are capable of processing the information in their represented form, e. g. providing an interface for natural-language processing. The trust in these services (e. g., Google, Wikipedia, Wolfram Alpha) can be reduced through the use of decentralized verification as proposed by ChainLink, assuming that the service cannot distinguish verification attempts from regular requests to their services. In addition, the stability of information must be taken into account, i. e., the verification must be resilient to short-time changes, e. g., malicious users manipulating the information to their advantage and then triggering the settlement process. This is feasible, if Wikipedia is used as a knowledge base, but can be prevented by also considering the information history.

However, with more complex expiration conditions, we also see the possibility that data items can become valid again after they have expired. Examples are scenarios in which data are supposed to be available only on specific days of the week, or have a daily access limit (under the assumption that the number of accesses can be verified reliably). This property makes the use of smart contracts a much more powerful instrument than previous approaches.

Financial Reserve Model

In order to guarantee the payout of penalties, the provider needs to place a deposit in the contract that is paid out when the contract is violated. However, in the case of large-scale application of our system, this would lead to large amounts of provider capital locked in the smart contract. Thus, we propose that only a fractional reserve (e. g., 1%) has to be deposited in the contract, penalties are paid from the pool of all deposits, and that the provider has the possibility to withdraw money from the contract as long as the total amount is above the reserve threshold. This threshold is determined by the number of data items covered by the contract. If an item has expired and no violation has been reported for an adequate period of time, this item can be taken into account with less weight for calculating the threshold.

Large-scale violations that exceed the contract capacity determined by the total amount of deposits can still be handled resorting to the jurisdictional system. In this case, the contract can even be used as a piece of evidence to support that user and provider have agreed on the expiration of data beforehand.

Prototype Implementation

In this section, we describe our prototype implementation and evaluate the transaction cost incurring in its use and the scalability in terms of the numbers of data items that can be protected. Our contract employs time-based expiration conditions for data items that can be identified with a unique ID. We have implemented our prototype system using Ethereum with a local blockchain using the Go Ethereum (Geth) client. We have initialized Ethereum accounts representing a user, a provider, and the external service, as well as a smart contract in which items can be managed. For experimental interactions, i. e., registering or checking items with the smart contract, we utilized the Ethereum Mist Wallet application.

Smart Contract

Our Smart Contract consists of roughly 200 lines of Solidity code, is deployed on a local private blockchain, and available on GitHub1 . The registration process consists of two steps that can be executed in arbitrary order. Both owner and provider have to commit information to create a valid entry. A user can register data in addItem(), providing as inputs its identifier and the remaining time it is intended to be available. The provider approves registration by using the function confirmItem(), also passing the identifier, the time left, and the owner's Ethereum address to the contract. We aim to ensure that the contract balance covers a minimum proportion of all registered data. After both parties have committed to the registration, the item agreement has become valid.

Data owners can be remove their data from the contract by calling the function removeItem(), which represents a cancellation of the agreement. Likewise, the provider can also withdraw confirmed items from the contract, as long as the owner has not added it.

The function verifyAccess() initiates the verification, whether data with a given identifier is available. In general, this function can be invoked by anyone and at any time, but the verification will only be triggered if the expiration date as stated in the record has been reached. However, access verification must be conducted by a data feed service external to the blockchain. For our prototype, we used an external script providing basic functionality. If the check is successful, the service can invoke the contract function itemFound(), which will initiate the compensation process. Thus, the contract will send the specified amount of Ether from its balance to the picture owner. In exceptional circumstances, i. e., if there is a widespread distribution of violations and many settlement processes are initiated at the same time, the Ether transfer may fail due to a low contract balance. The function claimPending(id) allows the user to initiate the compensation retroactively when the accessibility after expiration has already been verified before.

Evaluation

The feasibility of our approach mainly depends on the transaction cost arising from the use of the contract and the number of agreements that can be achieved in total.

Transaction fees in Ethereum, referred to as gas, generally depend on the complexity of the transaction, but can also be specified by the transaction sender. If a lower fee is selected, it may take a longer time-span for the transaction to be processed. As of December 2018, waiting times for transaction processing have been 45 seconds [8] on average. This time-span seems acceptable, as our application is not time-sensitive in terms of a few minutes. In Table 1, we illustrate the cost for the six transactions offered by our contract and the actor who needs to provide the fee on triggering the transaction. We assume an exchange rate of $100.00 per Ether and a transaction fee of 1 GWei. At the time of writing, miners of 30% of total blocks have accepted this or even a lower fee [8]. However, these numbers are constantly changing, due to the current network load. Registering a new data item to the contract requires a user to provide a transaction fee of 0.8 cents. For a user who uploads one item per day, this results in a total amount of roughly $3.00 per year. For each item confirmation, the provider has to bear costs of 0.35 cents. The cost of the other transactions will only incur in case of a contract violation. When we assume that the penalty for the violation is significantly higher (even in the range of a few dollars), the additional transaction cost will be negligible.

The amount of gas consumed by all transactions to be included in a new Ethereum block is limited to 8 million. When the contract registration requires 117,553 gas (see Table 1), and a new block is created every 15 seconds on average, this allows roughly 390,000 new registrations each day (2.75 million per week) under the assumption that the overall Ethereum network is not used for any other means. In 2017, Google has received roughly 2000 removal requests under European privacy law on a weekly basis [START_REF]European Privacy Requests for Search Removals[END_REF], which is well below 0.1% of the limit that could be achieved within Ethereum.

Discussion

In this section, we discuss the effect of our proposal on trust assumptions and privacy aspects of practical implementations.

Trust Requirements Whereas we have introduced smart contracts for data revocation to reduce the trust required in providers when users upload personal data on their platforms, the use of data feeds still requires a certain level of trust. We consider the data feed a neutral adjudicator and, therefore, trust requirements in these entities are less critical than in providers who have -due to their business models -interest in making user content accessible as long as possible. However, trust in particular services is reduced by the presence of several alternatives users can ideally pick from, and also an approach based on crowd-sourcing. With regular other users serving as verifiers, it becomes harder for providers to make false attestations to data feeds to circumvent a violation detection, as regular accesses cannot be distinguished from accesses for verification purposes.

Metadata Privacy

The data accessible to smart contracts is stored on the blockchain, a distributed and publicly readable and irrevocable data structure. This may lead to two challenges:

First, the arising database might be a valuable target for an adversary who aims to collect all the sensitive data prior to expiration. This mainly depends on the number of data items covered by the contract and can particularly become a problem when our system is only used for sensitive data. However, if there is also sufficient non-sensitive data covered by the contract, which we advocate for, an attacker cannot directly reason that the data is sensitive just from its presence in the contract.

Second, the contract data can reveal information about the privacy preferences of individual users. If many data items registered in the contract belong to the same owner, it is evident that this user attaches importance to privacy in common and data revocation in particular. On the other hand, we can also conclude that this user also shares a lot of data publicly. We assume that the blockchain interactions involving a specific user provide pseudonymity, without direct linkability to a concrete person. Thus, information derived from the contract does not comprise an additional privacy leak.

Provider Participation We see the use of smart contracts to register user data and specify expiration conditions similar to establishing a regular contract. Thus, a fundamental requirement is the willingness of service providers to support such a mechanism and active participation in the protocol. For a successful registration of a particular agreement, the provider must commit information to the contract. We cannot ultimately prevent that the provider might refrain from entering the agreement in specific individual cases. However, such a misbehavior can be observed, as there will be open registration requests by users, which are publicly visible on the blockchain. This makes it possible for a user to check upfront whether a provider actually complies with the system, before finally uploading new data.

Recent studies [START_REF] Ayalon | Retrospective Privacy: Managing Longitudinal Privacy in Online Social Networks[END_REF][START_REF] Mondal | Forgetting in Social Media: Understanding and Controlling Longitudinal Exposure of Socially Shared Data[END_REF] have found out that users of online social networks are actively employing privacy preferences as offered by the providers for their data. Therefore, we assume that applying a service for data revocation as we propose can make social networks more attractive to users, especially to those who are generally more concerned about privacy issues. Moreover, our scheme can be utilized as a reputation mechanism, in that providers use the system to demonstrate that they take user privacy seriously as they comply with the preferences defined in the contract. If more providers apply the system, they can even compete with each other in reaching the lowest violation rate. From a regulatory point of view, our approach can be considered as a technical instantiation for establishing the users' right to be forgotten. In the future, technical revocation mechanisms, but also our proposal for contractual agreements can provide directions towards the automated handling of such removal requests. This seems desirable not only for the users but also for providers, in that it renders the manual check of revocation requests and dealing with individual cases unnecessary.

Related Work

Cryptographic erasure mechanisms to enforce digital forgetting have been well studied. One of the first approaches was Ephemerizer by Perlman [START_REF] Perlman | The Ephemerizer: Making Data Disappear[END_REF]. Vanish [START_REF] Geambasu | Vanish: Increasing Data Privacy with Self-Destructing Data[END_REF] uses distributed hash tables for key distribution EphPub [START_REF] Castelluccia | EphPub: Toward Robust Ephemeral Publishing[END_REF] and Neuralyzer [START_REF] Zarras | Neuralyzer: Flexible Expiration Times for the Revocation of Online Data[END_REF] use the Domain Name System as infrastructure for key distribution, and Reimann and Dürmuth [START_REF] Reimann | Timed Revocation of User Data: Long Expiration Times from Existing Infrastructure[END_REF] leverage the continuous change of website contents for key expiration. Amjad et al. [START_REF] Amjad | Forgetting with Puzzles: Using Cryptographic Puzzles to support Digital Forgetting[END_REF] propose an approach raising the effort required to access data to prevent large-scale adversarial data collection during the lifetime of data. Chen et al. [START_REF] Chen | Sanitizing Data is Not Enough!: Towards Sanitizing Structural Artifacts in Flash Media[END_REF] propose a method to delete not only data but also remaining structural artifacts on a hardware level.

Opposed to data revocation scenarios, approaches exist to keep data secret after its publication until a certain release condition is fulfilled. Li and Palanisamy [START_REF] Li | Timed-Release of Self-Emerging Data Using Distributed Hash Tables[END_REF] present a scheme leveraging distributed hash tables that is built on the cryptographic foundations of time-lock encryption [START_REF] Mahmoody | Time-Lock Puzzles in the Random Oracle Model[END_REF][START_REF] Rivest | Time-lock Puzzles and Timed-release Crypto[END_REF]. In this context, Jager [START_REF] Jager | How to build time-lock encryption[END_REF] shows that blockchain technology can be leveraged to emulate real-world-time in a computational model.

Studies have explored how much users are willing to pay to recover data that have become inaccessible [START_REF] Spiekermann | Towards a Value Theory for Personal Data[END_REF] and for improvements in data privacy in an online shopping scenario [START_REF] Tsai | The Effect of Online Privacy Information on Purchasing Behavior: An Experimental Study[END_REF]. González et al. [START_REF] González Cabañas | FDVT: Data Valuation Tool for Facebook Users[END_REF] present a tool for computing the value of personal data uploaded to Facebook based on the financial revenue generated from the data, which can be useful to determine appropriate penalty amounts in our contract.

Integrating blockchain technology with privacy scenarios raises challenges in handling sensitive personal information. In this context, approaches to change the blockchain history without omitting advantages such as public verifiability have been proposed [START_REF] Ateniese | Redactable Blockchain-or-Rewriting History in Bitcoin and Friends[END_REF][START_REF] Puddu | µchain: How to Forget without Hard Forks[END_REF]. Kosba et al. [START_REF] Kosba | Hawk: The Blockchain Model of Cryptography and Privacy-Preserving Smart Contracts[END_REF] introduce a framework for privacypreserving smart contracts by developing a blockchain model of cryptography.

Conclusion

In this paper, we have developed an approach for the support of data revocation. Different from previous work, we did not use cryptographic measures, but combined both technical and regulatory aspects in order to incentivize the provider to delete data as determined by its owner. Based on this idea, we have developed a protocol for the specification of revocation conditions in smart contracts and implemented a prototype that supports time-based revocation conditions and is processed on a local Ethereum blockchain. The contract incorporates a penalty mechanism for data that remains available deviating from the conditions in the contract. With our approach, users can take action both proactively in defining expiration conditions for data they have published, and also retroactively in that they can get compensation in case the data provider has failed to delete data as specified.

Fig. 2 .

 2 Fig. 2. Protocols of the registration, access probing, and violation settlement processes.

Table 1 .

 1 Cost of contract execution. We assume gas fees of 1 GWei and an Ethereum exchange rate of $100.00.

	Transaction Gas USD	Actor
	Create	82,446 $0.0082	User
	Confirm	35,107 $0.0035 Provider
	CheckExpiry 27,199 $0.0027	User
	VerifyAccess 28,621 $0.0029	User
	ItemFound 22,071 $0.0022 Data Feed
	ClaimPending 21,922 $0.0022	User

https://github.com/theoschnitzler/data-revocation-contract/

Acknowledgments. This research was supported by the BMBF InStruct project under grant 16KIS0581.