The Information Commissioner’s Office (ICO) is exploring how to launch a Statutory Regulatory Sandbox (SRS) designed to test innovations that would be impossible without violating data protection requirements.
The UK’s data regulator said that sandboxes, which are controlled and time-limited environments in which businesses can test new technologies under relaxed or modified rules, have proved to be an important part of the regulatory toolkit.
However, it has noted that sandboxes have their limits, including the “ability to use live personal information in cases that push the boundaries of the data protection principles” as well as “creating space for issues that require multiple regulators to balance risks across different domains”.
To ensure sandboxes can be effectively used in situations that would require greater flexibility with regards to data protection, the ICO produced a report with support from the Regulatory Innovation Office to “help frame the conversation and contributes to policy development as the government advances its thinking around the Regulating for Growth Bill and the AI Growth Lab”.
The ICO has determined that a data protection sandbox is feasible, but the government and the regulator itself would need to address challenges such as protecting the independence of the ICO and ensuring that individual rights are transparently protected.
It also said that public trust must be heavily considered, so that people are happy and willing to support innovations that could deliver benefits without fear that their rights will be infringed upon.
The ICO said that the potential impact for an effective data protection SRS could unlock “significant” economic opportunities and societal benefits.
“We know that this kind of tool is most effective when organisations are willing to engage and invest. That is why the ICO is also committing to improving our own existing sandbox offering to make it run faster, with clearer outputs and conclusions for those who participate,” said the ICO.
“Any SRS would require changes to data protection legislation, so it will be for government to decide next steps. In the meantime, the ICO will continue to evolve our current offering to ensure it meets the needs of innovators and the public alike, and we will continue to work on new use cases at the heart of the UK economy, like legal services.”
