The National Data Protection Authority (ANPD) has once again moved towards fulfilling its regulatory agenda, this time in the area of Artificial Intelligence (AI). On October 3, 2023, ANPD announced the opening of a new call for contribution (consulta pública) to carry out a regulatory sandbox in the area of Artificial Intelligence and personal data protection in Brazil.
This is a regulatory sandbox pilot program by ANPD, aimed at collecting relevant information and data that will allow the understanding of different points of view of stakeholders who may be affected by future regulation in AI and data protection.
The Call for Contributions on the AI Regulatory Sandbox is based on a Technical Study by ANPD called Regulatory Sandbox on AI and Data Protection in Brazil, with the aim of "presenting how regulatory sandboxes can be used by a Data Protection Authority to contribute to the regulation of emerging technologies". The Study will not substantiate a specific sandbox program, but will serve as a reference guide in the planning and execution of pilot projects and future editions of ANPD sandboxes. In this opportunity, Artificial Intelligence was the chosen subject for the pilot program.
Artificial Intelligence and Personal Data Protection
LGPD, in its article 20, touches upon the use of AI by providing for the right of the personal data subject to request the review of decisions made solely based on automated processing that affects their interests. The data subject may be discriminated against, as a result of automated processing that affects decisions aimed at defining the personal, professional, consumer and credit profile or aspects of their personality, for example. The same scenario can happen when, based on a certain automated treatment made possible by artificial intelligence tools, the data subjects suffer real impacts on their lives.
The Technical Study reports on case studies verified in regulatory sandbox benchmarks of other authorities around the world, presenting relevant characteristics, in addition to containing a roadmap to implement a sandbox, considering the macro phases of planning and execution, which are: (i) defining objectives; (ii) identifying interested parties; (iii) defining scope, duration, funding and human resources; (iv) identifying risks and mitigation mechanisms; (v) defining criteria for participation; (vi) preparing technical documents to start the sandbox. The planned stages are: (i) submission of proposals; (ii) preparation of participants; (iii) testing; (iv) closure or exit.
ANPD held bilateral dialogues with the following entities: (i) promoters of sandbox programs (Development Bank of Latin America and the Caribbean - CAF and Datasphere Initiative); (ii) Data Protection Authorities of Norway (Datatilsynet), the United Kingdom (ICO), Singapore (PDPC) and Colombia (SIC); and (iii) other regulators in Brazil (BCB and ANATEL).
As it has been the case with other topics placed under Calls for Contributions by ANPD, the regulation of this topic was already provided for in ANPDs Regulatory Agenda for the 2023/2024 biennium, under Phase 3. The Public Consultation on the AI regulatory sandbox will be open to contributions by society until November 1, 2023. Contributions must be sent exclusively through the Participa + Brasil platform, and can be made by both Brazilians and foreigners, whether from the public or private sector.
What is a Regulatory Sandbox?
“Sandbox” is literal meaning refers to a space delimited by a box containing sand, in which experiments can be carried out, allowing a return to the original state and different repetitions of the process, without impacting the external environment.
This concept has served as an inspiration for regulatory agents in Brazil and around the world to test innovations and models with controlled and limited impact to the agents participating in the experiment, without violating current regulations. In this context, this experimentation has been called a regulatory sandbox.
Prior to this ANPD initiative, other Brazilian regulators had already been implementing sandbox initiatives, such as the Brazilian Securities and Exchange Commission (CVM), the Central Bank of Brazil (BCB), the Superintendence of Private Insurance (SUSEP), among others.
Next Steps
Based on innovation in the controlled sandbox environment, ANPD intends to implement good practices to ensure compliance with personal data protection rules. According to ANPDs practice so far, it is expected that the Authority will prepare, following the receipt and analysis of contributions within the scope of Public Consultations, regulations on the subject consulted, in addition to guidelines that will serve as a basis for the development of other rules that may be necessary for the discipline of the AI system. The competence of ANPD to issue regulations after conducting Public Consultations or Calls for Contributions is provided for by LGPD (Brazilian Data Protection Act – Law 13,709/2018) in article 55-J, XIII, paragraph 2.
In addition, it is important to remember that there is a Bill of Law under analysis in the Senate on the use of Artificial Intelligence – Bill of Law 2,338/2023. More details about this Bill can be found in a note released by the TMT team of Azevedo Sette Advogados, available here.
The Technology, Media and Telecommunications team of Azevedo Sette Advogados follows up on the development of this theme and is available for questions and contributions on the matter.