ICO publishes new Tech Horizons Report

To view the ICO's new Tech Horizons Report, click here.

What has happened?

This is the second such report published by the ICO and follows an earlier Tech Horizons report which the ICO produced in December 2022.

The ICO’s intention is that by identifying the privacy and data protection implications of emerging technologies before they are widely used, the ICO will be better placed to proactively set out its regulatory responses and enable innovators to consider these challenges in the design phase of development. Although the report is not formal guidance, it nevertheless provides a useful indication of the new and emerging technologies that the ICO is likely to focus on in the coming years, and the data protection issues that will need to be addressed as these technologies develop.

What does the report say?

The ICO has identified the following eight “priority technologies” that the ICO considers likely to have a particularly significant impact, which are discussed in the report:

• “Genomics: The sequencing of the human genome to improve understanding of a broad range of traits, mostly used in healthcare. There is further potential for these insights to be used in fields such as employment, sports and education.
• Immersive virtual worlds: Highly immersive virtual environments, also known as the metaverse, in which users can interact with each other and make use of digital services, such as e-commerce and gaming.
• Neurotechnologies: Consumer, enterprise and healthcare devices and procedures, both invasive and non-invasive, that directly record and process neuro-data to gather information, control interfaces or devices, or modulate neural activity.
• Quantum computing: By taking advantage of phenomena at the atomic scale, quantum computing may in future be able to resolve highly complex computational problems that current computers cannot, but may also present serious risks to existing encryption.
• Commercial use of drones: Unmanned aerial vehicles (UAVs) used in commercial settings, for example in delivery and e-commerce, monitoring, and crowd control.
• Personalised AI: The customisation of large language models, based on individual users’ search patterns and personal preferences and characteristics, to create more tailored user experiences and better-targeted outputs.
• Next-generation search: Next generation search engines incorporating new technologies, such as embedded AI capabilities, as well as voice-based, image-based and ambient elements.
• Central bank digital currencies (CBDCs): A new form of central bank-issued digital money, which would complement physical cash and other payment mechanisms in facilitating everyday payment needs.”

The report contains a detailed chapter on each of these new technologies, each of which explains the underlying technology for the relevant topic and its emerging use cases; sets out the current state of play surrounding its adoption and development; and discusses the possible future privacy and data protection risks that these new technologies may present.

The ICO recognises that each of the technologies discussed in the report presents unique opportunities as well as challenges. On the one hand, the ICO acknowledges that these new technologies could bring significant benefits, and could “improve our health, our social interactions, our environment and how we do business”. Equally, however, the ICO has also identified a number of overarching trends and dynamics that will need to be addressed as these technologies develop:

• “New innovations across fields like neurotechnology, immersive technologies and genomics allow organisations to collect novel types of intimate information about people. As innovators seek to harness the significant benefits these new technologies may offer, it is important they build in appropriate safeguards from the outset.
• Many new technologies collect and process increasingly large amounts of personal information to better personalise experiences. The scale and complexity of this processing makes it increasingly difficult for people to understand how organisations are using their information and what the combining of different pieces of information may reveal about them.
• We have seen an accelerated pace of innovation in the past 12 months, especially in the field of AI. The increased use of AI in other technology domains, from neurotechnology to search, has resulted in a rapid increase in new uses and developments that the ICO, as the regulator, will need to keep up to date with.
• Multiple organisations are involved in processing people's information, leading to a lack of clarity. This makes it harder for people to understand who is processing their information, and how they can exercise their information rights. The ICO considers that being transparent will be critical to maintaining people's trust.
• The misuse of several of the technologies considered in the report could particularly impact people who already need extra support to protect themselves. The ICO has highlighted the need for organisations to ensure they put appropriate safeguards in place, as well as ensuring that innovative new solutions do not also introduce new types of harm or discrimination.”

The ICO recognises that many organisations continue to build data protection by design into their innovations, but notes that others may need guidance or may need to work with the ICO to consider how they can engineer privacy into their innovations.

The ICO has indicated that it intends to address the issues proactively as these technologies mature and as the ICO’s role in regulating develops. In particular, the ICO has stated that it will:

• involve the public in decisions about how the ICO, as a regulator, addresses the risks and benefits these new innovations may present;
• continue to invite innovators to work with the ICO’s Regulatory Sandbox to engineer data protection into these technologies from the outset, focussing on the most innovative propositions;
• share further insights on priority technologies by developing foresight reports, starting with quantum and genomics in 2024;
• continue to work closely with the ICO’s partner regulators - the Competition and Markets Authority (“CMA”), the Financial Conduct Authority (“FCA”), and Ofcom - at the Digital Regulation Collaboration Forum to act on shared regulatory challenges and opportunities; and
• continuously scan the horizon for further developments that require the ICO’s immediate attention and possible intervention.

What’s next?

It is important to note that the report is not formal guidance, and at this stage represents only the ICO’s early views on often highly uncertain and evolving technology areas. The ICO has also stressed that the recommendations set out in the report do not necessarily reflect its current or future policy positions, and that its thinking around the technologies discussed will continue to evolve as those technologies mature. Nevertheless, the report still provides a helpful indication of the ICO’s current views on the issues it discusses. In addition, the ICO’s work around emerging technologies offers an opportunity for industry to work with the ICO and to play a role in shaping the ICO’s future approach to regulation in this area, for example through participating in the ICO’s Regulatory Sandbox.

Overall, the report is an encouraging development for businesses and demonstrates the ICO’s commitment to working with industry and supporting innovators in addressing emerging data protection risks and opportunities. Although the ICO’s work in this area is at an early stage and we will need to wait and see how the ICO’s thinking evolves, organisations looking to develop or deploy emerging technologies should still consider taking advantage of opportunities to engage with the ICO through the Regulatory Sandbox and the ICO’s various other innovation initiatives. The ICO has also indicated that we can expect further developments in the form of foresight reports on quantum computing and genomics during 2024, as well as updates to existing guidance; in particular, the report suggests that the ICO will be reviewing and updating its current guidance on AI to take account of new use cases as part of its wider portfolio of AI work.

In summary, the report provides a useful insight into the ICO’s possible future regulatory approach in relation to emerging technologies – and it will certainly be interesting to see how the ICO’s work in this space develops in the coming months.