The ICO publishes Innovation Hub Project Report

The Innovation Hub

The Regulators’ Business Innovation Privacy Hub (the Innovation Hub) was established with the aim of partnering with other regulators to provide advice and support to innovative businesses for building data protection compliance into their innovative products and services. Since it was formed, the Innovation Hub has worked with 8 other regulators to increase business awareness of data protection across three sectors: finance and ‘open’ ecosystems, legal and health and care.

The Innovation Hub has initially been funded by the UK Department for Business, Energy & Industrial Strategy (BEIS) Regulators’ Pioneer Fund, but will continue to run past this funding period to become part of the ICO’s Technology and Innovation Service. The Innovation Hub’s future work will include, among other things, increasing its collaboration with other regulators and continue contributing to Open Banking initiatives and supporting certain parts of the Innovation service provided by the UK Financial Conduct Authority (FCA).

Workstreams

Examples of the support the ICO has provided to the finance and ‘open’ ecosystems, legal and health sectors include:

• Finance and ‘open’ ecosystems
  The Innovation Hub has provided support on data protection issues to companies receiving help from some of the FCA’s Innovation services and has collaborated with the Open Banking Implementation Entity to draft guidance on processing personal data for those operating within the open banking ecosystem.

• Legal
  The Innovation Hub has supported the Legal Access Challenge (a joint project between the UK Solicitors Regulation Authority and Nesta) and provided advice to Legal Utopia (a social LawTech venture) on data protection matters.

• Health and care
  The Innovation Hub has advised NHSX on the data protection implications of developing and regulating AI and participated in cross-government events and roundtables in the health and care sectors about relevant regulatory reform.

As well as the above, the Innovation Hub has worked with other regulators through the UK Regulators’ Network to support vulnerable individuals. This has included, for example, assisting the Gambling Commission to provide better support for those likely to suffer harm from gambling.

Top tips for innovators

As part of the report, the Innovation Hub also produced ten top tips for any innovative firm wishing to develop products and services using personal data. These tips set out that:

1. Data protection is good for business as it will, among other things, lead to increased customer confidence.

2. Data protection will continue to be relevant, even as technology advances.

3. Education on data protection and a firm’s obligations in respect of data protection is key.

4. Firms should take a “data protection by design and default” approach. Data protection compliance should therefore be built into innovative products from the beginning.

5. Firms should consider completing a data protection impact assessment to discover and deal with any data protection risks linked to their products.

6. Firms should determine what they are doing with personal data before deciding what personal data needs to be collected.

7. With respect to data sharing and data portability, firms should inform consumers where their data is going and why and use appropriate security measures.

8. Firms should know about the data protection obligations with respect to AI (where relevant).

9. Firms should consider using synthetic data when they are testing a product.

10. The ICO can provide advice and support and the Innovation Hub can also assist if a firm is already working with another regulator in their sector.

Innovative firms should take note of the above data protection top tips and continue to monitor the work of the Innovation Hub for support on data protection matters related to their business.