Chapter VI
Article 59
Processing of Personal Data in AI Regulatory Sandboxes
Plain-Language Summary
Allows personal data lawfully collected for other purposes to be processed in AI regulatory sandboxes for developing AI systems in the public interest, subject to strict safeguards. This constitutes a limited derogation from GDPR purpose limitation.
Keywords
personal dataGDPRregulatory sandboxpurpose limitationpublic interestsafeguardsdata processing
Legal Text
Article 59 — Processing of Personal Data in AI Regulatory Sandboxes 1. In the AI regulatory sandbox, personal data lawfully collected for other purposes may be processed for the purposes of developing, training and testing certain innovative AI systems in the sandbox when all of the following conditions are met: (a) the AI systems shall be developed for safeguarding substantial public interest in one or more of the following areas: public safety, protection against serious threats, public health or protection of the environment; (b) the data are necessary for complying with requirements under this Regulation; (c) specific safeguards and conditions are implemented to ensure GDPR compliance. 2. Any personal data processed pursuant to this Article shall not be used for any other purpose and shall be deleted when it is no longer necessary for the sandbox purposes. Participants shall document the categories of personal data processed.