Unpacking the ICO’s third edition of the Tech Horizon Report

The Information Commissioner’s Office (ICO) has published the third edition of its Tech Horizon Report, a series which helps organisations navigate the data protection implications of certain emerging technologies that are expected to be widely adopted in the coming years. The first edition of this report, published in 2022, examined privacy concerns related to extended reality hardware (our blog on this edition can be found here), while the second edition, released in 2024, had a more nuanced vision of future virtual worlds. The latest report explores four more technologies that may significantly affect society, the economy and information rights in the next two to seven years. 

The new technologies

As with previous editions, the ICO selects a few technologies (according to specific criteria): 

• Connected transport which captures vehicle-to-everything (V2X) communication technology. This is transforming how vehicles operate and interact with their environment and people. Examples include emergency braking or lane change warnings, which use a combination of sensors, cameras, GPS and wireless connectivity to enable cars to collect and share information.
• Quantum sensing and enhanced imaging are used in many industries, such as defence and transport, to improve capabilities in measuring and capturing change. The report focuses on the health sector, where the technology is being used for various non-invasive diagnostics. 
• Digital diagnostics, therapeutics and healthcare infrastructure refers to medical interventions driven by software used to prevent, manage or treat medical disorders. The report discusses recent developments such as smart pills, and also builds on its guidance around consumer-health tech products from the first edition.
• Synthetic media is content partially or entirely generated using AI or machine learning, which often involves the use of personal data. The report focuses on deepfakes and the rising concern over the potential misuse of personal data in the creation and distribution of this content. The ICO sets out several recommendations such as the use of watermarking, particularly as deepfakes are becoming nearly impossible to detect.

Common issues and trends

For each technology, the report identifies various data protection issues. Broadly, these include: 

• Novel types of personal data: Emerging technologies can create new types of information about individuals, for example, around brain patterns or driver fatigue. While this data could offer valuable insights, organisations must ensure they do not collect or retain more information than necessary, and have a justifiable reason for the collection, especially in medical and healthcare contexts. 
• Informed consent: Technologies like V2X are continuously collecting personal data. This can make it difficult for users to opt out of data collection, and provide informed consent. The ICO emphasises that organisations need to adopt appropriate mechanisms to obtain consent, especially when data is being collected from multiple individuals in a shared environment, like a vehicle. 
• Lack of transparency and accountability: The development of these technologies involves a complex network of innovators, which could lead to a lack of transparency and accountability. Organisations need to clearly identify who is responsible for the processing of personal data, whether as a controller or processor, and ensure legal obligations are complied with. 
• Complexity and volume of data: The increasingly large amounts of personal data collected and the complexity of the processing makes it difficult for individuals to understand how their information is used, but organisations are still expected to articulate this use. The ICO also recommends that PETs are utilised to help ensure the data is appropriately secured (you can read more about PETs in our recent blog). 

Significance of this report 

The Tech Horizon Reports are not a one-off exercise, rather they represent a continual process of tracking emerging technologies, refining guidance in response, and collaborating with industry stakeholders. This edition is the first that has also taken a retrospective view of technologies covered in previous reports and provides an update on the ICO’s activities in relation to these technologies. For example, the ICO has published papers on quantum technologies and genomics, and contributed to a foresight paper on immersive technologies prepared by the Digital Regulation Cooperative Forum. The ICO has also held consultations and roundtables in respect of personalised AI and next-generation IoT. 

The emphasis is clear: these technologies are inevitable. Organisations need to be empowered with the right tools, including how to implement privacy by design and by default principles, so that, as a society, we can benefit. This report plays an important role in ensuring that organisations are considering data privacy from the very start, from the design stage to implementation and potentially widespread use.