Apply Article 59 Safeguards When Further Processing Personal Data in an AI Regulatory Sandbox

Sub-obligations

These are independently assessable parts of the parent requirement.

1. Article 59(1)(a)-(b)

   Current

   Demonstrate Public-Interest Purpose and Necessity for Sandbox Personal Data Processing

   Tracker Networks Guidance

   Ensure the AI project serves one of the specified substantial public-interest areas and that the personal data are necessary for meeting high-risk AI requirements that cannot effectively be fulfilled with anonymised, synthetic or other non-personal data.

   Official text

   (a) AI systems shall be developed for safeguarding substantial public interest by a public authority or another natural or legal person and in one or more of the following areas: (i) public safety and public health, including disease detection, diagnosis prevention, control and treatment and improvement of health care systems; (ii) a high level of protection and improvement of the quality of the environment, protection of biodiversity, protection against pollution, green transition measures, climate change mitigation and adaptation measures; (iii) energy sustainability; (iv) safety and resilience of transport systems and mobility, critical infrastructure and networks; (v) efficiency and quality of public administration and public services; (b) the data processed are necessary for complying with one or more of the requirements referred to in Chapter III, Section 2 where those requirements cannot effectively be fulfilled by processing anonymised, synthetic or other non-personal data;

   Suggested controls

   • AI Regulatory Sandbox Personal-Data Governance

     Govern conditional further processing of personal data in an AI regulatory sandbox under Article 59.

   Related risks

   • AI Regulatory Sandbox Personal-Data Compliance Failure

     Personal data used in a regulatory sandbox may be processed outside Article 59 conditions or without sufficient safeguards.

2. Article 59(1)(c)

   Current

   Monitor and Respond to High Risks to Data-Subject Rights During Sandbox Processing

   Tracker Networks Guidance

   Maintain effective mechanisms to identify high risks to data-subject rights and freedoms and promptly mitigate those risks or stop processing where necessary.

   Official text

   (c) there are effective monitoring mechanisms to identify if any high risks to the rights and freedoms of the data subjects, as referred to in Article 35 of Regulation (EU) 2016/679 and in Article 39 of Regulation (EU) 2018/1725, may arise during the sandbox experimentation, as well as response mechanisms to promptly mitigate those risks and, where necessary, stop the processing;

   Suggested controls

   • AI Regulatory Sandbox Personal-Data Governance

     Govern conditional further processing of personal data in an AI regulatory sandbox under Article 59.

   Related risks

   • AI-Related Fundamental Rights or Discrimination Harm

     AI use may create discriminatory, unfair or other material adverse impacts on individuals or groups.

   • AI Regulatory Sandbox Personal-Data Compliance Failure

     Personal data used in a regulatory sandbox may be processed outside Article 59 conditions or without sufficient safeguards.

3. Article 59(1)(d)-(e)

   Current

   Segregate, Secure and Restrict Sharing of Sandbox Personal Data

   Tracker Networks Guidance

   Process sandbox personal data in a functionally separate, isolated and protected environment under provider control with authorised access only. Further sharing of originally collected data must comply with data-protection law and personal data created in the sandbox must not be shared outside it.

   Official text

   (d) any personal data to be processed in the context of the sandbox are in a functionally separate, isolated and protected data processing environment under the control of the prospective provider and only authorised persons have access to those data; (e) providers can further share the originally collected data only in accordance with Union data protection law; any personal data created in the sandbox cannot be shared outside the sandbox;

   Suggested controls

   • Special-Category Data Safeguards

     Apply enhanced necessity, privacy, security, access, retention and documentation controls when special-category data is used for qualifying bias activities.

   • AI Regulatory Sandbox Personal-Data Governance

     Govern conditional further processing of personal data in an AI regulatory sandbox under Article 59.

   Related risks

   • Misuse of Sensitive or Special-Category Personal Data

     Sensitive or special-category personal data may be processed, disclosed or retained inappropriately in AI activities.

   • AI Regulatory Sandbox Personal-Data Compliance Failure

     Personal data used in a regulatory sandbox may be processed outside Article 59 conditions or without sufficient safeguards.

4. Article 59(1)(f)

   Current

   Prevent Sandbox Processing From Affecting Data Subjects and Protect Their Rights

   Tracker Networks Guidance

   Ensure sandbox personal-data processing does not lead to measures or decisions affecting data subjects and does not interfere with their data-protection rights.

   Official text

   (f) any processing of personal data in the context of the sandbox neither leads to measures or decisions affecting the data subjects nor does it affect the application of their rights laid down in Union law on the protection of personal data;

   Suggested controls

   • AI Regulatory Sandbox Personal-Data Governance

     Govern conditional further processing of personal data in an AI regulatory sandbox under Article 59.

   Related risks

   • AI-Related Fundamental Rights or Discrimination Harm

     AI use may create discriminatory, unfair or other material adverse impacts on individuals or groups.

   • AI Regulatory Sandbox Personal-Data Compliance Failure

     Personal data used in a regulatory sandbox may be processed outside Article 59 conditions or without sufficient safeguards.

5. Article 59(1)(g)-(h)

   Current

   Protect, Delete and Log Personal Data Processed in the Sandbox

   Tracker Networks Guidance

   Apply appropriate technical and organisational safeguards, delete personal data when sandbox participation ends or the retention period expires, and retain processing logs for the duration of sandbox participation unless other law provides otherwise.

   Official text

   (g) any personal data processed in the context of the sandbox are protected by means of appropriate technical and organisational measures and deleted once the participation in the sandbox has terminated or the personal data has reached the end of its retention period; (h) the logs of the processing of personal data in the context of the sandbox are kept for the duration of the participation in the sandbox, unless provided otherwise by Union or national law;

   Suggested controls

   • Regulatory Documentation Retention

     Retain required AI compliance documentation for mandated periods and ensure it remains retrievable.

   • AI Regulatory Sandbox Personal-Data Governance

     Govern conditional further processing of personal data in an AI regulatory sandbox under Article 59.

   Related risks

   • Misuse of Sensitive or Special-Category Personal Data

     Sensitive or special-category personal data may be processed, disclosed or retained inappropriately in AI activities.

   • Failure to Retain Required AI Records

     Required documentation or logs may not remain complete, available and retrievable for mandated periods.

   • AI Regulatory Sandbox Personal-Data Compliance Failure

     Personal data used in a regulatory sandbox may be processed outside Article 59 conditions or without sufficient safeguards.

6. Article 59(1)(i)-(j)

   Current

   Document Sandbox Training, Testing and Validation and Prepare the Required Project Summary

   Tracker Networks Guidance

   Keep a complete description of the training, testing and validation process and rationale with results in the technical documentation, and prepare the short project summary needed for publication on the competent authority's website, subject to the sensitive-operational-data exception.

   Official text

   (i) a complete and detailed description of the process and rationale behind the training, testing and validation of the AI system is kept together with the testing results as part of the technical documentation referred to in Annex IV; (j) a short summary of the AI project developed in the sandbox, its objectives and expected results is published on the website of the competent authorities; this obligation shall not cover sensitive operational data in relation to the activities of law enforcement, border control, immigration or asylum authorities.

   Suggested controls

   • High-Risk AI Technical Documentation Management

     Create, maintain and review technical documentation demonstrating compliance with applicable high-risk AI requirements.

   • AI Regulatory Sandbox Personal-Data Governance

     Govern conditional further processing of personal data in an AI regulatory sandbox under Article 59.

   Related risks

   • Inadequate High-Risk AI Technical Documentation

     Required technical documentation may be incomplete, outdated or insufficient to demonstrate compliance.

   • AI Regulatory Sandbox Personal-Data Compliance Failure

     Personal data used in a regulatory sandbox may be processed outside Article 59 conditions or without sufficient safeguards.