Lawmakers’ efforts to enact privacy law in the United States show no signs of slowing in 2021. On March 2, 2021, Gov. Ralph Northam, D-Va., signed into law Virginia’s Consumer Data Privacy Act. Bills in Florida are currently progressing through the committee process. As proposals continue to move through state legislatures, Congress will come under increasing pressure to pass a comprehensive national law.

By mid-2020, at least 11 federal privacy bills were under discussion; still, others addressed specific privacy issues related to facial recognition and biometric data. The Setting an American Framework to Ensure Data Access, Transparency, and Accountability Act, introduced by Sen. Roger Wicker, R-Miss., the Consumer Online Privacy Rights Act, introduced by Sens. Maria Cantwell, D-Wash., and Rep. Suzan DelBene’s, D-Wash., Information Transparency and Personal Data Control Act will likely be key to negotiations. 

But even as this work goes forward, policymakers recognize legislation rarely keeps pace with emerging technology and data-processing methods and seldom anticipates unexpected advances in business models and digital applications. Companies seeking to innovate while meeting compliance obligations are often challenged by requirements found in even the most up-to-date laws. 

An emerging tool to address this gap — regulatory sandboxes for privacy — may hold the potential to promote both advances in digital technology and applications and effective privacy protections for consumers. For developers of cutting-edge digital products, services and business models, regulatory sandboxes can serve as controlled environments where they can experiment with new offerings while benefiting from the guidance of privacy regulators. 

A recently published report by Business at OECD (BIAC) explores the potential of sandboxes as a device in privacy regulation. Policymakers and practitioners have long recognized that the rapid pace of digital innovation challenges the ability of data protection law and policy to keep pace with the most recent developments in technology and data processing. Companies experimenting with disruptive technologies and data uses struggle to comply with existing regulations, while regulators face the challenge of understanding rapid, complex changes in a dynamic market.

The BIAC report examines how regulatory sandboxes can help both companies and regulators address these concerns. It draws on the experience of regulators, including the U.K. Information Commissioner’s Office and Singapore's Personal Data Protection Commission — Infocomm Media Development Authority. It also reflects the findings of companies. Facebook implemented its own regulatory sandbox to explore notice and consent issues and AI Transparency and Explainability. GSMA has worked with the Association of Southeast Asian Nations to explore the potential of regulatory sandboxes for privacy in multi-jurisdictional settings. The report also highlights Novartis’s experience of working in the U.K. ICO sandbox.

As the BIAC report observes, regulatory sandboxes for privacy create opportunities for innovators, with guidance from regulators, to test how cutting-edge, unanticipated technologies and data uses can be deployed in a way that complies with privacy and data protection law. By experimenting in the sandbox and benefiting from a regulator’s advice and compliance assessment, companies can bring offerings to market more quickly and with greater confidence that they are operating within the law and are not exposed to enforcement actions.

The guidance available in the sandbox can be particularly valuable for smaller companies that may be agile and able to make use of the most recent data-processing methods but may lack the resources necessary to establish an extensive legal team or the opportunity to benefit from a consultation with regulators. Smaller companies may also be able to learn from the experience of businesses of similar size working in the sandbox. 

But regulators benefit too.

Sandboxes provide them with a close-up view of the most recent advances in data processing and an understanding of the strengths and limitations of existing regulation. Ideally, these insights encourage the adoption of law and policy that furthers effective protections without unduly slowing innovation. In one example, the BIAC paper highlights the practical experience of Singapore's PDPC and how the regulatory sandbox for privacy resulted in policy prototyping. It notes that in the sandbox, regulators, companies and the public can in some cases co-create guidance that helps companies more readily innovate while meeting the intent and the requirements of law.

Such policy prototyping could benefit future legislative efforts. Participation in regulatory sandboxes could yield a greater understanding of emerging technology, what companies must do to comply and a better sense of whether effective protections result from legislative measures. These practical insights could equip lawmakers to craft future legislation and policy that is forward-looking, effective and pragmatic, and that ideally optimizes both privacy and opportunities for innovation.

The potential of regulatory sandboxes for privacy to deliver real value is clear, but if they are to succeed, consumers, regulators and the market will need to trust that they are run fairly and that their outcomes are reliable. More is needed to foster credible sandbox testing, including:

• Resources and infrastructure — technical arrangements for data sharing, a clearly established application process, funding for regulators and incentives to encourage companies to participate.
• Regulatory clarity — companies’ responsibilities to comply with regulation and how regulators will address failures to meet legal obligations when operating in the sandbox.
• Governance — criteria for determining who can participate in the sandbox and rules to determine when sandbox testing begins and ends, how outcomes are evaluated, and when and how findings should be made available to the public.
• Requirements for cross-border regulatory sandboxes for privacy — multinational frameworks and guidelines for international cooperation.

The BIAC document proposes the Organization for Economic Cooperation and Development undertake work to explore these and other questions related to how regulatory sandboxes for privacy can be created and run in a way that benefits stakeholders, promotes innovation and protects consumers.

Photo by Markus Spiske on Unsplash