Privacy & Cybersecurity Law Blog

On October 11, 2018, the Centre for Information Policy Leadership (“CIPL”) at Hunton Andrews Kurth LLP submitted comments to the UK Information Commissioner’s Office (“ICO”) in response to its call for views on creating a regulatory sandbox.

The regulatory sandbox concept is intended to provide a supervised safe space for piloting and testing innovative products, services, business models or delivery mechanisms in the real market, using the personal data of real individuals. The concept was first developed by the UK’s Financial Conduct Authority to enable regulated companies to experiment and innovate in the financial services space. The model may be particularly suited for and well received in the data protection community, where technical innovation has an impact on data protection and where there is an increasing recognition that compliance has to be treated as an iterative process.

In its comments, CIPL identifies the main benefits of participation in the regulatory sandbox, sets out various practical suggestions to maximize the prospects of success of the regulatory sandbox and lays out specific safeguards which the ICO should adopt in its deployment of the concept.

In particular, CIPL’s response details:

• benefits of sandbox participation for individuals, organizations, the ICO itself, society and the economy;
• actual and hypothetical examples of where sandbox participation may be helpful, both in the private and public sectors;
• practical considerations around the operation of the sandbox concept and features that can be included to maximize the prospects of its success;
• criteria for acceptance into the sandbox;
• the relationship between the sandbox and data protection impact assessments; and
• safeguards which must be considered to address real concerns that are likely to arise from prospective sandbox participants.

CIPL has previously written about the potential of a regulatory sandbox model in data protection as a critical tool for innovation in digital society while ensuring data protection in its 2017 paper Regulating for Results: Strategies and Priorities for Leadership and Engagement.