November 26, 2018

In September 2018, the ICO published a call for views on the development of a regulatory sandbox. It was keen to explore a wide range of issues, from identifying areas where data protection might be perceived as a barrier to innovation, to the general scope of the sandbox, as well as more detailed questions about what mechanisms and operational approaches it should take.

The ICO has received nearly 70 responses from companies, trade associations, public authorities, third sector bodies and others.

The ICO’s analysis sets out some key themes that emerged and provides comment from the ICO under each of the survey sections.

The ICO says that the sandbox is likely to be broad in scope and open to any sector and any size of organisation. However, it also plans to make use of eligibility criteria to control entry in three main areas: innovation, public benefit and “fitness to participate”. It is also planning to encourage applications in particular from those organisations that are dealing with specific data protection challenges that were flagged in responses as being central to enabling innovation.

The ICO also clarifies that this will not be a sandbox in which it will provide test environments, dummy data sets or software tools. Further, organisations will not receive “certification” for participating. The ICO explains that it is about working collaboratively with innovators through a range of informal steers and supportive advisory mechanisms to support the dual goals of privacy and innovation. In addition, it intends to continue to explore what other mechanisms, such as “letters of comfort”, might be feasible.

The ICO plans to undertake further consultation in the New Year, which will include events for organisations interested in the project. These are provisionally scheduled to take place early in February 2019. To read the ICO’s blog post in full and for a link to its analysis document, click here.