Like any area of governance, regulating data privacy must answer to a higher national ambition. We need to think bigger and use all available tools to create opportunities that will propel us towards a highly competitive, data-driven nation.
Among the most critical assets of governments, institutions, and companies in the 21st century are personal data. Personal data processing has accelerated as the Covid-19 pandemic continues — triggering the necessity for a more agile response, especially from government and companies, technological innovations, and public-private partnerships.
Arguably, the Covid-19 pandemic is a positive nudge that hastened the digitization of our lives as a path forward.
The private sector’s shift to digitization at such a short period is remarkable. But to cope with the work-from-home setup, many corporations quickly adopted innovative solutions such as Artificial Intelligence to augment the limitations brought by distance and remote work.
The NPC explores the regulatory sandbox or what others call regulatory pilot space, an enabler of innovation. It will allow businesses, start-ups, tech and information society service providers, or “innovators” in general to conduct “experiments” in a controlled regulatory setting.
Sandboxing gives companies the chance to pilot-test whatever ideas they have in an environment that typifies the market but directly engages with the regulator.
These companies can draw from the expertise and advice of the NPC team on how to mitigate risks and embed privacy by design in their plans. This way, the regulatory pilot space ensures the protection of consumers and data subjects despite not having fixed rules and regulations on specific innovations.
Also, applying a regulatory sandbox allows companies to keep up with the current and emerging technological trends. For the NPC, it gives us ringside seats to assess the impact of technologies on the privacy of individuals.
Regulatory sandbox involves a pre-set experimental cycle.
The maximum period could be one year in certain existing regulatory frameworks covering specific sectors like insurance. The period may be extended, with the regulator’s imprimatur upon request of the entities.
The exit plan is crucial because it provides long-term protection to consumers. Thus the regulatory sandbox application must contain a straightforward methodology to scale up the technological solution to access a larger market and a plan for the clients should the proposed innovation be discontinued.
The method of regulation changes depending on the progress of a particular regulatory sandbox.
Therefore, there is a need for reporting. The report contains the proof of the gain or regress based on the screening parameters, percentage of completion of or phase/s completed in the experimentation cycle, and other concerns (any information not given to the NPC during the application process but are significant).
A completion report is required at the end of the experimentation cycle. It should contain an overview of how the live testing happened and an objective assessment of the potential impact of the technological solution to be scaled up.
The NPC sees the importance of the regulatory sandboxing or pilot space policy to foster innovation and growth. We are developing this service to support our companies in creating new products and services using personal data in the new environment spawned by the pandemic. And for them to be able to leverage the asset innovatively and safely.