Context
William Malcolm, the ICO’s Executive Director Regulatory Risk and Innovation, has published a blog discussing the ICO’s Regulatory Sandbox and how it is evolving to meet the challenges and demands of new technology, including AI.
Key points to note and next actions
- For more than eight years the ICO’s Regulatory Sandbox has been a place for organisations to test new ideas, explore data protection risks and build privacy into new products and services by design.
- Sandboxes have proved an important part of the regulatory toolkit for responding to fast moving technology deployment and deployment cycles, but more can be done to ensure that these regulatory tools are meeting the moment.
- The ICO is committed to ensuring that its investment in innovation services and regulatory sandboxes has the largest possible impact.
- It is one of four regulators supporting government’s new Advisory AI Growth Lab (AIGL) for legal services and it is working closely with the FCA, helping firms develop, test and evaluate AI through the FCA’s AI Lab. It has also been involved in piloting an AI and digital hub, which is a multi-agency service for projects that need advice from all four regulators: the CMA, FCA, Ofcom and ICO.
- Here is a snapshot of the findings from the ‘ICO Statutory Regulatory Sandbox: final report’:
- A data protection SRS is feasible but government and the ICO would need to address important challenges, including protecting the ICO’s independence and ensuring that individual rights are transparently protected through alternative but equivalent accountability and governance mechanisms;Public trust must be at the heart of the SRS with innovations delivering clear public benefit. People are willing to see new and novel data use in cases that deliver better services and outcomes for everyone; and
- Demand for an SRS is niche, but the potential impact is significant if we can unlock key economic opportunities and societal benefits faster.
- The ICO is committed to improving its existing sandbox offering to make it run faster, with clearer outputs and conclusions for those who participate. However, it is urging organisations to commit to bringing the hard problems and to accept that co-creation is also about accepting limits on tech deployment where privacy, safety and individual rights are at play.
- Any SRS would require changes to data protection legislation, so it will be for government to decide next steps.