Are you struggling with privacy regulations related to artificial intelligence? In a way, the DPA does the same. Because in such a recent field, there is little case law to refer to. The technology is at the forefront of law. But the Data Protection Authority's sandbox for responsible artificial intelligence can provide mutual help.
It is only just over six months since the sandbox was launched. But it gets attention and publicity at home and abroad, and it is already ready for the second application round. The sandbox is an offer where legal and technological expertise from the Norwegian Data Protection Authority collaborates with AI developers to find privacy-friendly solutions. Participants get answers to their questions and hopefully solutions to their problems. The Norwegian Data Protection Authority is given the opportunity to go in depth on GDPR-related AI issues, and thus the law develops by mapping legal gray areas.
- I think the sandbox is an effective method for exploring the boundaries of innovation and privacy - and not least how these two can go hand in hand, says Kari Laumann, project manager at the sandbox.
The point of a regulatory sandbox is that the DPA should not just be a police force that comes with index fingers and hefty fines when someone breaks the privacy clauses. In the sandbox, the audit must be creative and constructive together with entrepreneurs and organizations that want to develop AI technology in line with good privacy. The goal is for the sandbox to promote innovation on the AI front.
- If we are to be able to take advantage of the fantastic opportunities that technology offers us, it is important to explore boundaries. This sandbox makes it possible in an exciting way. It is great to see how the companies and the authorities work together for socially beneficial and privacy-friendly AI, says Minister of District and Digitization Linda Hofstad Helleland.
When a new application round is now opened with deadline the 15th of September, Laumann can refer to good experiences from the first round. Age Labs, KS, NAV and Secure Practice, which were selected, are well underway with their sandbox exploration.
Laumann sums up the experiences in three words: exciting, challenging and fun.
- Dialogue is the key word in the sandbox, and I experience that there are good discussions in all projects. This is a new way of working for all parties and it can be challenging. But it's fun to be in the exploration phase in search of different solutions.
- The sandbox method is a bit new, but it is spreading. There are several sandboxes within fintech, and we are in contact with inspections in other countries that have established sandboxes or plan to do so. Sandboxes have been proposed by the EU Commission as a measure to promote AI innovation, Laumann explains.
For each individual sandbox participant, it is a unique opportunity to get the privacy experts in the DPA to go into depth on the issues. Getting this type of thorough guidance is not something the Data Protection Authority normally can offer individual actors outside the sandbox.
- I experience that there is great motivation to achieve good privacy in the solutions that are developed in Norwegian companies. The sandbox is a unique opportunity to get help to build in privacy in a good way from the start, says Laumann.
Some basic criteria are set for the sandbox applicants, including that the AI solution must use personal data. Apart from that, the sandbox opens up a wide range of applicants from both the private and public sector, large and small players and from all industries. And Laumann has good advice for those who throw themselves over the application form:
- It is important to us that the applicants have one or more specific issues related to artificial intelligence and privacy. And otherwise we are particularly interested in choosing projects that can shed light on topics more people are wondering about.
In the first application round this winter, there were 25 applications. What does Laumann think about the size of the application pile when the deadline expires on the 15th of September?
- Hmm! Experiences from other sandboxes indicate that there are fewer applications than in the first round. But of course we are betting on the opposite. We will get more than 25 in round two!